truthmark 2.2.7 → 2.3.1

package/dist/main.js

@@ -42,8 +42,14 @@ var renderJson = (result) => {
   return JSON.stringify(toStableValue(result), null, 2);
 };
 
-// src/config/command.ts
-import fs3 from "fs/promises";
+// src/init/init.ts
+import fs6 from "fs/promises";
+
+// src/config/load.ts
+import fs2 from "fs/promises";
+import path2 from "path";
+import { Ajv } from "ajv";
+import { parse } from "yaml";
 
 // src/fs/paths.ts
 import path from "path";
@@ -54,6 +60,7 @@ var isPathInsideRoot = (rootDir, targetPath) => {
 var isNodeErrorWithCode = (error, code) => {
   return error instanceof Error && "code" in error && error.code === code;
 };
+var isExcludedPath = (targetPath, excludedRoots) => excludedRoots.some((root) => isPathInsideRoot(root, targetPath));
 var pathSegments = (absolutePath) => {
   return absolutePath.split(path.sep);
 };
@@ -101,10 +108,15 @@ var resolveRepoPath = (rootDir, relativePath) => {
   }
   return resolvedPath;
 };
-var isSafeExactFile = async (rootDir, relativePath, allowMissing) => {
+var isSafeExactFile = async (rootDir, relativePath, allowMissing, excludedRoots = []) => {
   try {
     const absolutePath = resolveRepoPath(rootDir, relativePath);
     await assertRepoContainment(rootDir, absolutePath);
+    if (isExcludedPath(
+      await resolveThroughExistingAncestor(absolutePath),
+      excludedRoots
+    ))
+      return false;
     const relative = path.relative(rootDir, absolutePath);
     const segments = pathSegments(relative);
     if (segments.length === 0 || segments.every((segment) => segment.length === 0)) {
@@ -138,6 +150,43 @@ var isSafeExactFile = async (rootDir, relativePath, allowMissing) => {
     return false;
   }
 };
+var resolveSafeExactFileTarget = async (rootDir, relativePath, allowMissing, allowFinalSymlink, excludedRoots = []) => {
+  if (await isSafeExactFile(rootDir, relativePath, allowMissing, excludedRoots)) {
+    const absolutePath = resolveRepoPath(rootDir, relativePath);
+    try {
+      const [resolvedRootDir, resolvedPath] = await Promise.all([
+        fs.realpath(rootDir),
+        fs.realpath(absolutePath)
+      ]);
+      return {
+        path: toRepoRelativePath(resolvedRootDir, resolvedPath),
+        aliased: false
+      };
+    } catch (error) {
+      if (!allowMissing || !isNodeErrorWithCode(error, "ENOENT")) return null;
+      return {
+        path: toRepoRelativePath(rootDir, absolutePath),
+        aliased: false
+      };
+    }
+  }
+  if (!allowFinalSymlink) return null;
+  try {
+    const absolutePath = resolveRepoPath(rootDir, relativePath);
+    if (!(await fs.lstat(absolutePath)).isSymbolicLink()) return null;
+    const resolvedPath = await fs.realpath(absolutePath);
+    await assertRepoContainment(rootDir, resolvedPath);
+    if (isExcludedPath(resolvedPath, excludedRoots)) return null;
+    const stat = await fs.lstat(resolvedPath);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) return null;
+    return {
+      path: toRepoRelativePath(await fs.realpath(rootDir), resolvedPath),
+      aliased: true
+    };
+  } catch {
+    return null;
+  }
+};
 var assertRepoContainment = async (rootDir, targetPath) => {
   const [resolvedRootDir, resolvedTargetPath] = await Promise.all([
     resolveThroughExistingAncestor(rootDir),
@@ -213,81 +262,6 @@ var ensureRepoFile = async (rootDir, relativePath, content) => {
   };
 };
 
-// src/git/repository.ts
-import fs2 from "fs/promises";
-import { realpathSync } from "fs";
-import path2 from "path";
-import { execa } from "execa";
-var realpathOrResolved = async (targetPath) => {
-  try {
-    return await fs2.realpath(targetPath);
-  } catch {
-    return path2.resolve(targetPath);
-  }
-};
-var runGit = async (cwd, args, reject = true) => {
-  const result = await execa("git", args, { cwd, reject });
-  return {
-    stdout: result.stdout,
-    exitCode: result.exitCode ?? 1
-  };
-};
-var getGitRepository = async (cwd) => {
-  const worktreePath = await realpathOrResolved(
-    (await runGit(cwd, ["rev-parse", "--show-toplevel"])).stdout.trim()
-  );
-  const commonDirOutput = (await runGit(cwd, ["rev-parse", "--git-common-dir"])).stdout.trim();
-  const commonDir = await realpathOrResolved(path2.resolve(worktreePath, commonDirOutput));
-  const repositoryRoot = path2.basename(commonDir) === ".git" ? path2.dirname(commonDir) : worktreePath;
-  const branchResult = await runGit(cwd, ["symbolic-ref", "--quiet", "--short", "HEAD"], false);
-  const headResult = await runGit(cwd, ["rev-parse", "--verify", "HEAD"], false);
-  const branchName = branchResult.exitCode === 0 ? branchResult.stdout.trim() : null;
-  const headSha = headResult.exitCode === 0 ? headResult.stdout.trim() : null;
-  const isDetached = branchName === null;
-  const isUnborn = !isDetached && headSha === null;
-  return {
-    repositoryRoot,
-    worktreePath,
-    branchName,
-    headSha,
-    isDetached,
-    isUnborn
-  };
-};
-var resolveWorktreePath = (repository, relativePath) => {
-  const resolvedPath = path2.resolve(repository.worktreePath, relativePath);
-  let currentPath = resolvedPath;
-  const missingSegments = [];
-  const resolveContainedPath = () => {
-    while (true) {
-      try {
-        return missingSegments.reduceRight((resolvedExistingPath, segment) => {
-          return path2.join(resolvedExistingPath, segment);
-        }, realpathSync(currentPath));
-      } catch (error) {
-        if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
-          throw error;
-        }
-        const parentPath = path2.dirname(currentPath);
-        if (parentPath === currentPath) {
-          return resolvedPath;
-        }
-        missingSegments.unshift(path2.basename(currentPath));
-        currentPath = parentPath;
-      }
-    }
-  };
-  const containedPath = resolveContainedPath();
-  if (containedPath !== repository.worktreePath && !containedPath.startsWith(`${repository.worktreePath}${path2.sep}`)) {
-    throw new Error("resolved path must stay inside the active worktree");
-  }
-  return resolvedPath;
-};
-
-// src/templates/init-files.ts
-import path3 from "path";
-import { stringify } from "yaml";
-
 // src/config/schema.ts
 var SUPPORTED_PLATFORMS = [
   "codex",
@@ -457,348 +431,276 @@ var createDefaultConfig = () => ({
   ignore: ["node_modules/**", "vendor/**", "dist/**", "build/**"]
 });
 
-// src/routing/areas.ts
-import { parse } from "yaml";
-var TRUTH_DOCUMENT_KINDS = [
-  "product-capability",
-  "engineering-behavior",
-  "engineering-contract",
-  "engineering-workflow",
-  "engineering-architecture",
-  "engineering-operations",
-  "engineering-test-behavior"
-];
-var uniqueSorted = (values) => [...new Set(values)].sort();
-var mergeTruthDocumentEntryRelationships = (first, second) => ({
-  ...first,
-  realizedBy: uniqueSorted([...first.realizedBy, ...second.realizedBy]),
-  realizes: uniqueSorted([...first.realizes, ...second.realizes]),
-  dependsOn: uniqueSorted([...first.dependsOn, ...second.dependsOn])
+// src/config/load.ts
+var ajv = new Ajv({ allErrors: true });
+var validateTruthmarkConfig = ajv.compile(truthmarkConfigSchema);
+var toConfigDiagnostic = (message, file) => ({
+  category: "config",
+  severity: "error",
+  message,
+  file
 });
-var DEFAULT_PRODUCT_TRUTH_DOCS_ROOT = "docs/truthmark/product";
-var DEFAULT_ENGINEERING_TRUTH_DOCS_ROOT = "docs/truthmark/engineering";
-var slugify = (value) => {
-  return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-};
-var createAreaDiagnostic = (message, area, severity = "error") => {
-  return {
-    category: "area-index",
-    severity,
-    message,
-    area
-  };
+var normalizeRepoRelativePath = (value) => {
+  const slashNormalized = value.replace(/\\/gu, "/");
+  return path2.posix.normalize(slashNormalized).replace(/\/+$/u, "");
 };
-var parseListSection = (sectionLines) => {
-  return sectionLines.map((line) => line.trim()).filter((line) => line.startsWith("- ")).map((line) => line.slice(2).trim().replaceAll("\\*", "*")).filter((line) => line.length > 0);
+var isUnsafeRepoRelativePath = (value) => {
+  const slashNormalized = value.replace(/\\/gu, "/");
+  const normalized = normalizeRepoRelativePath(value);
+  const parts = slashNormalized.split("/");
+  return normalized.length === 0 || normalized === "." || normalized === ".." || path2.isAbsolute(value) || path2.posix.isAbsolute(slashNormalized) || path2.win32.isAbsolute(value) || /^[A-Za-z]:/u.test(value) || normalized.startsWith("../") || parts.includes("..");
 };
-var isTruthDocumentKind = (value) => {
-  return typeof value === "string" && TRUTH_DOCUMENT_KINDS.includes(value);
+var joinWorkspacePath = (workspace, childPath) => {
+  return normalizeRepoRelativePath(`${workspace}/${childPath}`);
 };
-var inferTruthDocumentKindFromPath = (documentPath, options = {}) => {
-  const normalizedPath = documentPath.replaceAll("\\", "/");
-  const productTruthRoot = (options.productTruthRoot ?? DEFAULT_PRODUCT_TRUTH_DOCS_ROOT)?.replaceAll("\\", "/").replace(/\/+$/u, "");
-  const engineeringTruthRoot = (options.engineeringTruthRoot ?? options.truthDocsRoot ?? DEFAULT_ENGINEERING_TRUTH_DOCS_ROOT)?.replaceAll("\\", "/").replace(/\/+$/u, "");
-  if (productTruthRoot && normalizedPath.startsWith(`${productTruthRoot}/`)) {
-    return "product-capability";
-  }
-  if (engineeringTruthRoot && normalizedPath.startsWith(`${engineeringTruthRoot}/`)) {
-    if (normalizedPath.includes("/contracts/")) return "engineering-contract";
-    if (normalizedPath.includes("/workflows/")) return "engineering-workflow";
-    if (normalizedPath.includes("/architecture/"))
-      return "engineering-architecture";
-    if (normalizedPath.includes("/operations/"))
-      return "engineering-operations";
-    if (normalizedPath.includes("/tests/")) return "engineering-test-behavior";
-    return "engineering-behavior";
-  }
-  return null;
+var portalOutputFor = (workspace) => joinWorkspacePath(workspace, DERIVED_TRUTHMARK_PATHS.portalOutput);
+var pathsOverlap = (left, right) => {
+  const normalizedLeft = normalizeRepoRelativePath(left);
+  const normalizedRight = normalizeRepoRelativePath(right);
+  return normalizedLeft === normalizedRight || normalizedLeft.startsWith(`${normalizedRight}/`) || normalizedRight.startsWith(`${normalizedLeft}/`);
 };
-var inferTruthDocumentLaneFromPath = (documentPath, options = {}) => {
-  const normalizedPath = documentPath.replaceAll("\\", "/");
-  const productTruthRoot = (options.productTruthRoot ?? DEFAULT_PRODUCT_TRUTH_DOCS_ROOT).replaceAll("\\", "/").replace(/\/+$/u, "");
-  const engineeringTruthRoot = (options.engineeringTruthRoot ?? options.truthDocsRoot ?? DEFAULT_ENGINEERING_TRUTH_DOCS_ROOT).replaceAll("\\", "/").replace(/\/+$/u, "");
-  if (normalizedPath.startsWith(`${productTruthRoot}/`)) {
-    return "product";
+var CONFIG_PATH = ".truthmark/config.yml";
+var FORBIDDEN_WORKSPACE_OVERLAPS = [
+  ".git",
+  ".truthmark",
+  "package.json",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "src",
+  "tests"
+];
+var unsupportedShapeDiagnostics = (parsedConfig, configPath) => {
+  if (!parsedConfig || typeof parsedConfig !== "object" || Array.isArray(parsedConfig)) {
+    return [];
   }
-  if (normalizedPath.startsWith(`${engineeringTruthRoot}/`)) {
-    return "engineering";
+  const record = parsedConfig;
+  const diagnostics = [];
+  if (record.version !== 2) {
+    diagnostics.push(
+      toConfigDiagnostic(
+        "Unsupported Truthmark config shape. This release requires version: 2 with a truthmark workspace block.",
+        configPath
+      )
+    );
   }
-  return null;
-};
-var laneForTruthDocumentKind = (kind) => {
-  return kind.startsWith("product-") ? "product" : "engineering";
-};
-var docTypeForTruthDocumentKind = (kind) => {
-  if (kind.startsWith("product-")) {
-    return "product";
+  if ("docs" in record || "authority" in record) {
+    diagnostics.push(
+      toConfigDiagnostic(
+        "Unsupported Truthmark config shape. Remove old docs.roots and legacy authority settings; use version: 2 truthmark.workspace paths.",
+        configPath
+      )
+    );
   }
-  return kind.slice("engineering-".length);
+  return diagnostics;
 };
-var parseStringListField = (rawEntry, field) => {
-  if (!rawEntry || typeof rawEntry !== "object" || !(field in rawEntry)) {
-    return [];
-  }
-  const value = rawEntry[field];
-  if (!Array.isArray(value)) {
-    return [];
+var validateWorkspacePaths = (rawConfig, configPath) => {
+  const diagnostics = [];
+  const workspace = normalizeRepoRelativePath(rawConfig.truthmark.workspace);
+  if (isUnsafeRepoRelativePath(rawConfig.truthmark.workspace) || FORBIDDEN_WORKSPACE_OVERLAPS.some(
+    (forbidden) => pathsOverlap(workspace, forbidden)
+  )) {
+    diagnostics.push(
+      toConfigDiagnostic(
+        "truthmark.workspace must be a non-empty repo-relative directory that does not overlap repository control, package, source, test, or instruction paths.",
+        configPath
+      )
+    );
   }
-  return value.filter((entry) => typeof entry === "string");
+  return diagnostics;
 };
-var findTruthDocumentsYamlFenceRange = (sectionLines) => {
-  const trimmedLines = sectionLines.map((line) => line.trim());
-  const openingFenceIndex = trimmedLines.findIndex(
-    (line) => /^```(?:yaml|yml)?$/u.test(line)
+var normalizeConfig = (rawConfig) => {
+  const workspace = normalizeRepoRelativePath(rawConfig.truthmark.workspace);
+  const routesIndex = joinWorkspacePath(
+    workspace,
+    DERIVED_TRUTHMARK_PATHS.routesIndex
   );
-  if (openingFenceIndex === -1) {
-    return null;
-  }
-  const closingFenceIndex = trimmedLines.findIndex(
-    (line, index) => index > openingFenceIndex && line === "```"
+  const routeAreasRoot = joinWorkspacePath(
+    workspace,
+    DERIVED_TRUTHMARK_PATHS.routeAreasRoot
+  );
+  const productTruthRoot = joinWorkspacePath(
+    workspace,
+    DERIVED_TRUTHMARK_PATHS.productTruthRoot
+  );
+  const engineeringTruthRoot = joinWorkspacePath(
+    workspace,
+    DERIVED_TRUTHMARK_PATHS.engineeringTruthRoot
+  );
+  const templatesRoot = joinWorkspacePath(
+    workspace,
+    DERIVED_TRUTHMARK_PATHS.templatesRoot
+  );
+  const portalOutput = portalOutputFor(workspace);
+  const portalTemplate = joinWorkspacePath(
+    workspace,
+    DERIVED_TRUTHMARK_PATHS.portalTemplate
   );
   return {
-    openingFenceIndex,
-    closingFenceIndex: closingFenceIndex === -1 ? null : closingFenceIndex
-  };
-};
-var parseTruthDocumentsFromList = (sectionLines, areaName, options) => {
-  const diagnostics = [];
-  const truthDocuments = parseListSection(sectionLines);
-  const truthDocumentEntries = truthDocuments.map((documentPath) => {
-    const inferredKind = inferTruthDocumentKindFromPath(documentPath, options);
-    const inferredLane = inferTruthDocumentLaneFromPath(documentPath, options);
-    if (!inferredKind) {
-      diagnostics.push(
-        createAreaDiagnostic(
-          `Truth document ${documentPath} does not match a known kind path convention; defaulting to behavior.`,
-          areaName,
-          "review"
-        )
-      );
-    }
-    return {
-      path: documentPath,
-      kind: inferredKind ?? "engineering-behavior",
-      kindSource: inferredKind ? "inferred" : "defaulted",
-      lane: inferredLane ?? "engineering",
-      laneSource: inferredLane ? "inferred" : "defaulted",
-      realizedBy: [],
-      realizes: [],
-      dependsOn: []
-    };
-  });
-  return {
-    truthDocuments,
-    truthDocumentEntries,
-    diagnostics
+    version: rawConfig.version,
+    platforms: rawConfig.platforms ?? [...DEFAULT_PLATFORMS],
+    truthmark: {
+      workspace,
+      routes: {
+        index: DERIVED_TRUTHMARK_PATHS.routesIndex,
+        areas: DERIVED_TRUTHMARK_PATHS.routeAreasRoot,
+        defaultArea: DERIVED_TRUTHMARK_PATHS.defaultArea,
+        maxDelegationDepth: DERIVED_TRUTHMARK_PATHS.maxDelegationDepth
+      },
+      truth: {
+        productRoot: DERIVED_TRUTHMARK_PATHS.productTruthRoot,
+        engineeringRoot: DERIVED_TRUTHMARK_PATHS.engineeringTruthRoot
+      },
+      templates: {
+        root: DERIVED_TRUTHMARK_PATHS.templatesRoot
+      },
+      generated: {
+        portal: {
+          enabled: rawConfig.truthmark.generated.portal.enabled
+        }
+      },
+      paths: {
+        routesIndex,
+        routeAreasRoot,
+        productTruthRoot,
+        engineeringTruthRoot,
+        templatesRoot,
+        portalOutput,
+        portalTemplate
+      },
+      controlledPaths: [
+        routesIndex,
+        `${routeAreasRoot}/**/*.md`,
+        `${productTruthRoot}/**/*.md`,
+        `${engineeringTruthRoot}/**/*.md`,
+        `${templatesRoot}/*.md`
+      ]
+    },
+    frontmatter: {
+      required: rawConfig.frontmatter?.required ?? [],
+      recommended: rawConfig.frontmatter?.recommended ?? []
+    },
+    ignore: rawConfig.ignore ?? []
   };
 };
-var parseTruthDocumentsFromYaml = (sectionLines, areaName, options) => {
-  const yamlFenceRange = findTruthDocumentsYamlFenceRange(sectionLines);
-  if (!yamlFenceRange) {
-    return {
-      truthDocuments: [],
-      truthDocumentEntries: [],
-      diagnostics: []
-    };
+var compatibilityDiagnostics = (rawConfig, configPath) => {
+  if (!("instruction_targets" in rawConfig)) {
+    return [];
   }
-  if (yamlFenceRange.closingFenceIndex === null) {
-    return {
-      truthDocuments: [],
-      truthDocumentEntries: [],
-      diagnostics: [
-        createAreaDiagnostic(
-          `Area ${areaName} has an unterminated fenced YAML Truth documents block.`,
-          areaName
-        )
-      ]
-    };
+  return [
+    {
+      category: "config",
+      severity: "review",
+      message: "instruction_targets is accepted for compatibility but ignored; select platforms to control managed instruction-file writes.",
+      file: configPath
+    }
+  ];
+};
+var loadConfig = async (rootDir) => {
+  const absolutePath = resolveRepoPath(rootDir, CONFIG_PATH);
+  let source;
+  try {
+    source = await fs2.readFile(absolutePath, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return {
+        status: "missing",
+        config: null,
+        diagnostics: [
+          toConfigDiagnostic("Missing .truthmark/config.yml.", CONFIG_PATH)
+        ],
+        configPath: CONFIG_PATH
+      };
+    }
+    throw error;
   }
-  let parsedBlock;
+  let parsedConfig;
   try {
-    parsedBlock = parse(
-      sectionLines.slice(
-        yamlFenceRange.openingFenceIndex + 1,
-        yamlFenceRange.closingFenceIndex
-      ).join("\n")
-    );
+    parsedConfig = parse(source);
   } catch (error) {
     return {
-      truthDocuments: [],
-      truthDocumentEntries: [],
+      status: "invalid",
+      config: null,
       diagnostics: [
-        createAreaDiagnostic(
-          `Area ${areaName} has invalid YAML truth document metadata: ${error instanceof Error ? error.message : String(error)}.`,
-          areaName
+        toConfigDiagnostic(
+          `Invalid YAML: ${error instanceof Error ? error.message : String(error)}`,
+          CONFIG_PATH
         )
-      ]
+      ],
+      configPath: CONFIG_PATH
     };
   }
-  const rawEntries = parsedBlock && typeof parsedBlock === "object" && "truth_documents" in parsedBlock ? parsedBlock.truth_documents : null;
-  if (!Array.isArray(rawEntries)) {
+  const unsupportedDiagnostics = unsupportedShapeDiagnostics(
+    parsedConfig,
+    CONFIG_PATH
+  );
+  if (unsupportedDiagnostics.length > 0) {
     return {
-      truthDocuments: [],
-      truthDocumentEntries: [],
-      diagnostics: [
-        createAreaDiagnostic(
-          `Area ${areaName} must define a truth_documents array inside the fenced YAML block.`,
-          areaName
-        )
-      ]
+      status: "invalid",
+      config: null,
+      diagnostics: unsupportedDiagnostics,
+      configPath: CONFIG_PATH
     };
   }
-  const diagnostics = [];
-  const truthDocumentEntries = [];
-  for (const rawEntry of rawEntries) {
-    const path13 = rawEntry && typeof rawEntry === "object" && "path" in rawEntry ? rawEntry.path : null;
-    const kind = rawEntry && typeof rawEntry === "object" && "kind" in rawEntry ? rawEntry.kind : null;
-    const lane = rawEntry && typeof rawEntry === "object" && "lane" in rawEntry ? rawEntry.lane : null;
-    const inferredKind = typeof path13 === "string" ? inferTruthDocumentKindFromPath(path13, options) : null;
-    const inferredLane = typeof path13 === "string" ? inferTruthDocumentLaneFromPath(path13, options) : null;
-    const normalizedKind = isTruthDocumentKind(kind) ? kind : inferredKind;
-    const normalizedLane = lane === "product" || lane === "engineering" ? lane : normalizedKind ? laneForTruthDocumentKind(normalizedKind) : inferredLane;
-    if (typeof path13 !== "string" || path13.trim().length === 0 || !normalizedKind || !normalizedLane) {
-      diagnostics.push(
-        createAreaDiagnostic(
-          `Area ${areaName} truth_documents entries must include non-empty path plus valid lane and kind fields.`,
-          areaName
-        )
-      );
-      continue;
-    }
-    truthDocumentEntries.push({
-      path: path13.trim(),
-      kind: normalizedKind,
-      kindSource: isTruthDocumentKind(kind) ? "explicit" : "inferred",
-      lane: normalizedLane,
-      laneSource: lane === "product" || lane === "engineering" ? "explicit" : "inferred",
-      realizedBy: parseStringListField(rawEntry, "realized_by"),
-      realizes: parseStringListField(rawEntry, "realizes"),
-      dependsOn: parseStringListField(rawEntry, "depends_on")
-    });
+  if (!validateTruthmarkConfig(parsedConfig)) {
+    return {
+      status: "invalid",
+      config: null,
+      diagnostics: (validateTruthmarkConfig.errors ?? []).map(
+        (error) => {
+          const propertyPath = error.instancePath || "/";
+          const additionalProperty = error.keyword === "additionalProperties" && error.params && "additionalProperty" in error.params ? String(error.params.additionalProperty) : null;
+          const message = additionalProperty ? `${propertyPath} additional property ${additionalProperty} is not allowed` : `${propertyPath} ${error.message ?? "is invalid"}`.trim();
+          return toConfigDiagnostic(message, CONFIG_PATH);
+        }
+      ),
+      configPath: CONFIG_PATH
+    };
+  }
+  const pathDiagnostics = validateWorkspacePaths(
+    parsedConfig,
+    CONFIG_PATH
+  );
+  if (pathDiagnostics.length > 0) {
+    return {
+      status: "invalid",
+      config: null,
+      diagnostics: pathDiagnostics,
+      configPath: CONFIG_PATH
+    };
   }
   return {
-    truthDocuments: truthDocumentEntries.map((entry) => entry.path),
-    truthDocumentEntries,
-    diagnostics
+    status: "loaded",
+    config: normalizeConfig(parsedConfig),
+    diagnostics: compatibilityDiagnostics(
+      parsedConfig,
+      CONFIG_PATH
+    ),
+    configPath: CONFIG_PATH
   };
 };
-var parseTruthDocumentsSection = (sectionLines, areaName, options) => {
-  const yamlFenceRange = findTruthDocumentsYamlFenceRange(sectionLines);
-  if (!yamlFenceRange) {
-    return parseTruthDocumentsFromList(sectionLines, areaName, options);
-  }
-  const yamlResult = parseTruthDocumentsFromYaml(
-    sectionLines,
-    areaName,
-    options
-  );
-  if (yamlResult.diagnostics.length > 0 || yamlFenceRange.closingFenceIndex === null) {
-    return yamlResult;
-  }
-  return yamlResult;
+
+// src/config/render.ts
+import { parse as parse2, parseDocument, stringify } from "yaml";
+var normalizePlatforms = (platforms) => {
+  const selected = new Set(platforms);
+  return SUPPORTED_PLATFORMS.filter((platform) => selected.has(platform));
 };
-var parseAreasMarkdown = (source, options = {}) => {
-  const lines = source.split("\n");
-  const diagnostics = [];
-  const areas = [];
-  const truthDocumentReferences = [];
-  const areaFileReferences = [];
-  let areaIndex = 0;
-  let currentAreaName = null;
-  let currentSections = /* @__PURE__ */ new Map();
-  let currentSectionName = null;
-  const flushArea = () => {
-    if (!currentAreaName) {
-      return;
-    }
-    const truthDocumentResult = parseTruthDocumentsSection(
-      currentSections.get("Truth documents") ?? [],
-      currentAreaName,
-      options
-    );
-    const { truthDocuments, truthDocumentEntries } = truthDocumentResult;
-    const areaFiles = parseListSection(currentSections.get("Area files") ?? []);
-    const codeSurface = parseListSection(
-      currentSections.get("Code surface") ?? []
-    );
-    const updateTruthWhen = parseListSection(
-      currentSections.get("Update truth when") ?? []
-    );
-    const areaKey = slugify(currentAreaName);
-    const areaId = areaKey.length > 0 ? areaKey : `area-${areaIndex}`;
-    const hasTruthDocuments = truthDocuments.length > 0;
-    const hasAreaFiles = areaFiles.length > 0;
-    areaIndex += 1;
-    diagnostics.push(...truthDocumentResult.diagnostics);
-    if (hasTruthDocuments) {
-      truthDocumentReferences.push({
-        id: areaId,
-        name: currentAreaName,
-        key: areaKey,
-        truthDocuments,
-        truthDocumentEntries
-      });
-    }
-    if (hasTruthDocuments === hasAreaFiles || codeSurface.length === 0 || updateTruthWhen.length === 0) {
-      diagnostics.push(
-        createAreaDiagnostic(
-          `Area ${currentAreaName} must define exactly one of Truth documents or Area files, plus Code surface and Update truth when sections.`,
-          currentAreaName
-        )
-      );
-    } else if (hasAreaFiles) {
-      areaFileReferences.push({
-        id: areaId,
-        name: currentAreaName,
-        key: areaKey,
-        areaFiles,
-        codeSurface,
-        updateTruthWhen
-      });
-    } else {
-      areas.push({
-        id: areaId,
-        name: currentAreaName,
-        key: areaKey,
-        truthDocuments,
-        truthDocumentEntries,
-        codeSurface,
-        updateTruthWhen
-      });
-    }
-    currentAreaName = null;
-    currentSections = /* @__PURE__ */ new Map();
-    currentSectionName = null;
-  };
-  for (const line of lines) {
-    const areaHeadingMatch = line.match(/^\s{0,3}##\s+(.*)$/u);
-    if (areaHeadingMatch) {
-      const heading = areaHeadingMatch[1]?.trim() ?? null;
-      flushArea();
-      currentAreaName = heading === "Source References" ? null : heading;
-      continue;
-    }
-    if (!currentAreaName) {
-      continue;
-    }
-    if (/^(Truth documents|Area files|Code surface|Update truth when):$/u.test(
-      line.trim()
-    )) {
-      currentSectionName = line.trim().slice(0, -1);
-      currentSections.set(currentSectionName, []);
-      continue;
-    }
-    if (currentSectionName) {
-      currentSections.get(currentSectionName)?.push(line);
-    }
-  }
-  flushArea();
-  return {
-    areas,
-    truthDocumentReferences,
-    areaFileReferences,
-    diagnostics
-  };
+var renderConfig = (platforms = []) => {
+  const normalized = normalizePlatforms(platforms);
+  const config = createDefaultRawConfig();
+  if (normalized.length > 0) config.platforms = normalized;
+  return stringify(config);
+};
+var updateConfigPlatforms = (source, platforms) => {
+  const normalized = normalizePlatforms(platforms);
+  const parsed = parse2(source);
+  if (JSON.stringify(normalizePlatforms(parsed.platforms ?? [])) === JSON.stringify(normalized))
+    return source;
+  const document = parseDocument(source);
+  if (normalized.length === 0) document.delete("platforms");
+  else document.set("platforms", normalized);
+  return document.toString();
 };
 
 // src/truth/docs.ts
@@ -812,1521 +714,1614 @@ var resolveEngineeringTruthRoot = (config) => {
   return config.truthmark.paths.engineeringTruthRoot;
 };
 
-// src/templates/init-files.ts
-var asRelativePath = (value) => {
-  return value.split(path3.sep).join("/");
-};
-var currentDate = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-var resolveRelativePath = (fromPath, toPath) => {
-  return asRelativePath(path3.relative(path3.dirname(fromPath), toPath));
+// src/truth/evidence.ts
+var renderClaimEvidenceCheckedSection = (items) => {
+  return [
+    "Evidence checked:",
+    ...items.map((item) => {
+      return [
+        `- Claim: ${item.claim}`,
+        `  Evidence: ${item.evidence.join(" / ")}`,
+        `  Result: ${item.result}`
+      ].join("\n");
+    })
+  ].join("\n");
 };
-var truthRoot = resolveEngineeringTruthRoot;
-var renderLaneRootReadmeSummary = (lane) => {
-  if (lane === "product") {
-    return [
-      "Product truth owns capability promises, boundaries, decisions, and acceptance criteria.",
-      "Product lane docs state what must be true, why it matters, and what success means."
-    ].join(" ");
-  }
+var renderAuditEvidenceCheckedSection = (items) => {
   return [
-    "Engineering truth owns current realization, contracts, architecture, workflows, operations, and tests.",
-    "Engineering lane docs describe how the repository currently implements and operates the behavior."
-  ].join(" ");
+    "Evidence checked:",
+    ...items.map((item) => {
+      return [
+        `- Finding: ${item.finding}`,
+        `  Evidence: ${item.evidence.join(" / ")}`,
+        `  Suggested fix: ${item.suggestedFix}`,
+        `  Confidence: ${item.confidence}`
+      ].join("\n");
+    })
+  ].join("\n");
 };
-var renderLaneRootLeafDocGuidance = (lane) => {
-  if (lane === "product") {
-    return "README.md files are indexes, not Truth Sync targets. Keep product truth in bounded capability docs.";
-  }
-  return "README.md files are indexes, not Truth Sync targets. Keep engineering truth in bounded behavior, contract, architecture, workflow, operations, and test docs.";
+
+// src/agents/shared.ts
+var renderBulletLine = (line) => {
+  const normalized = line.trim().replace(/^-\s*/u, "");
+  return `- ${normalized}`;
 };
-var renderConfigTemplate = () => {
-  return stringify(createDefaultRawConfig());
+var renderBulletBlock = (lines, indent = "  ") => {
+  return lines.split(/\n/u).map((line) => line.trim()).filter((line) => line.length > 0).map((line) => `${indent}${renderBulletLine(line)}`).join("\n");
 };
-var titleCase = (value) => {
-  return value.split(/[-_\s]+/u).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1)).join(" ");
+var renderLaneClassificationRuleBlock = (config = defaultAgentConfig(), indent = "  ") => {
+  const [, ...rules] = renderLaneClassificationInstructions(config).split(/\n/u);
+  return renderBulletBlock(rules.join("\n"), indent);
 };
-var renderHierarchicalAreasIndexTemplate = (config) => {
-  const defaultArea = config.truthmark.routes.defaultArea;
-  const childPath = `${config.truthmark.paths.routeAreasRoot}/${defaultArea}.md`;
-  const title = titleCase(defaultArea);
-  const sourceOfTruth = resolveRelativePath(
-    config.truthmark.paths.routesIndex,
-    ".truthmark/config.yml"
+var renderReadOnlyLaneClassificationRuleBlock = (config = defaultAgentConfig(), indent = "  ") => {
+  const productTruthRoot = resolveProductTruthRoot(config);
+  const engineeringTruthRoot = resolveEngineeringTruthRoot(config);
+  return renderBulletBlock(
+    [
+      "classify the request or changed surface as product-lane, engineering-lane, both-lane, or ambiguous for reporting only",
+      `product-lane ownership belongs under ${productTruthRoot} and describes product promises, boundaries, rationale, decisions, and success criteria`,
+      `engineering-lane ownership belongs under ${engineeringTruthRoot} and describes source-backed current realization, contracts, architecture, workflows, operations, or tests`,
+      "both-lane ownership uses separate product and engineering docs cross-linked in route YAML with realized_by and realizes, not in doc frontmatter",
+      "ambiguous lane ownership should be reported for manual handoff or routed to Truth Structure",
+      LANE_INVARIANT
+    ].join("\n"),
+    indent
   );
-  return [
-    "---",
-    "status: active",
-    "doc_type: route-index",
-    `last_reviewed: ${currentDate()}`,
-    "---",
-    "",
-    "# Truthmark Areas",
-    "",
-    `## ${title}`,
-    "",
-    "Area files:",
-    `- ${childPath}`,
-    "",
-    "Code surface:",
-    "- src/**",
-    "",
-    "Update truth when:",
-    "- behavior changes affect the routed truth documents",
-    "- API contracts or current feature behavior changes",
-    "",
-    "## Source References",
-    "",
-    `- ${sourceOfTruth}`,
-    ""
-  ].join("\n");
 };
-var renderChildAreaTemplate = (config) => {
-  const defaultArea = config.truthmark.routes.defaultArea;
-  const title = titleCase(defaultArea);
-  const truthDocsRoot = truthRoot(config);
-  const bootstrapTruthDoc = `${truthDocsRoot}/${defaultArea}/bootstrap-routing.md`;
-  const templatePath = `${config.truthmark.paths.routeAreasRoot}/${defaultArea}.md`;
-  const sourceOfTruth = resolveRelativePath(
-    templatePath,
-    ".truthmark/config.yml"
-  );
+var DECISION_TRUTH_INSTRUCTIONS = [
+  "Decision truth lives in the canonical doc it governs; date active decisions inline when added or changed.",
+  "Do not create separate active-decision ADR/planning logs; replace the active decision and let Git history carry the audit trail.",
+  "Product decisions belong in product truth; engineering, architecture, contract, workflow, and operational decisions belong in engineering truth."
+].join("\n");
+var LANE_INVARIANT = "Do not make product docs a summary of engineering docs. Do not make engineering docs a detailed version of product docs. Product truth says what must be true and why. Engineering truth says how the repository currently realizes it.";
+var renderLaneClassificationInstructions = (config = defaultAgentConfig()) => {
+  const productTruthRoot = resolveProductTruthRoot(config);
+  const engineeringTruthRoot = resolveEngineeringTruthRoot(config);
   return [
-    "---",
-    "status: active",
-    "doc_type: area-route",
-    `last_reviewed: ${currentDate()}`,
-    "---",
-    "",
-    `# ${title} Areas`,
-    "",
-    `## ${title}`,
-    "",
-    "Truth documents:",
-    "```yaml",
-    "truth_documents:",
-    `  - path: ${bootstrapTruthDoc}`,
-    "    kind: engineering-workflow",
-    "    lane: engineering",
-    "```",
-    "",
-    "This is a provisional bootstrap route. It exists only to make fresh repositories routeable until real product, service, domain, or ownership areas are created.",
-    "",
-    "Code surface:",
-    "- src/**",
-    "",
-    "Update truth when:",
-    "- this provisional bootstrap route is the only match for a real code surface",
-    "- route ownership is still broad, mixed, or ambiguous",
-    "- Run Truth Structure before normal Truth Sync so the touched code gets a bounded owner",
-    "",
-    "## Source References",
-    "",
-    `- ${sourceOfTruth}`,
-    ""
+    "Lane review questions:",
+    "- before writing canonical truth docs, classify the request or change as product-lane, engineering-lane, both-lane, or ambiguous",
+    `- product-lane writes belong under ${productTruthRoot} and state product promises, boundaries, rationale, decisions, and success criteria`,
+    `- engineering-lane writes belong under ${engineeringTruthRoot} and state source-backed current realization, contracts, architecture, workflows, operations, or tests`,
+    "- both-lane work must write separate product and engineering docs and cross-link them in route YAML with realized_by and realizes, not in doc frontmatter",
+    "- ambiguous lane ownership must stop or invoke Truth Structure instead of writing a mixed document",
+    `- ${LANE_INVARIANT}`
   ].join("\n");
 };
-var renderBootstrapRoutingDocTemplate = (config) => {
-  const defaultArea = config.truthmark.routes.defaultArea;
-  const title = titleCase(defaultArea);
-  const templatePath = `${truthRoot(config)}/${defaultArea}/bootstrap-routing.md`;
-  const routePath = `${config.truthmark.paths.routeAreasRoot}/${defaultArea}.md`;
-  const routeSource = resolveRelativePath(templatePath, routePath);
-  const configSource = resolveRelativePath(
-    templatePath,
-    ".truthmark/config.yml"
-  );
-  const today = currentDate();
+var EVIDENCE_AUTHORITY_INSTRUCTIONS = [
+  "Repository instruction files and explicitly configured policy docs remain instruction authority when present; do not assume a repository uses any particular policy path.",
+  "Implementation code and canonical truth docs are inspected evidence for current behavior; they do not silently override workflow write boundaries."
+].join("\n");
+var REPOSITORY_INTELLIGENCE_INSTRUCTIONS = [
+  "Repository intelligence artifacts are optional derived context: RepoIndex, RouteMap, ImpactSet, and WorkflowState/action context may guide routing, write boundaries, and verification planning when available.",
+  "They do not override checkout evidence, canonical truth docs, route files, or workflow write boundaries.",
+  "If unavailable, inspect any present Truthmark config, route files, source files, truth docs, and tests directly, then report that repository-intelligence artifacts were not generated."
+].join("\n");
+var FEATURE_DOC_TEMPLATE_INSTRUCTIONS = [
+  "When creating or updating a truth doc, inspect the routed truth kind and use the matching template under the configured Truthmark templates root.",
+  "Supported kinds: product-capability, engineering-behavior, engineering-contract, engineering-architecture, engineering-workflow, engineering-operations, and engineering-test-behavior.",
+  "Treat the HTML comments under each template section as normative authoring guidance for that section.",
+  "Align existing docs to that template and write or repair section content so it satisfies the comment guidance while preserving accurate authored content.",
+  "If the template is missing, use lane-specific sections: product truth says what must be true and why; engineering truth says how the repository currently realizes it.",
+  "Teams may edit template files under the configured Truthmark templates root to define their local truth-doc standards."
+].join("\n");
+var TRUTH_DOC_AUTHORING_STYLE_INSTRUCTIONS = [
+  "Truth-doc prose style:",
+  "- Use professional, plain technical prose. Prefer specific current-state claims over promotional, symbolic, or generic significance language.",
+  "- Avoid common AI-writing tells: pivotal, crucial, underscores, serves as, stands as, showcases, landscape, vague expert attributions, and generic upbeat conclusions.",
+  "- Keep claims evidence-backed and diff-friendly: one durable claim per bullet or line; paragraphs should be no longer than one or two short sentences.",
+  "- Do not add personality, rhetorical flourish, first-person commentary, or marketing tone.",
+  "- Rewrite dense or formulaic prose only when it improves readability without removing scope, evidence, decisions, or source references."
+].join("\n");
+var renderTruthDocOwnershipGateSection = (subject, outcome) => {
   return [
-    "---",
-    "status: active",
-    "truth_kind: engineering-workflow",
-    `last_reviewed: ${today}`,
-    "---",
-    "",
-    `# ${title} Bootstrap Routing`,
-    "",
-    "## Purpose",
-    "",
-    `This doc records the provisional broad route for ${defaultArea}.`,
-    "This doc is a bootstrap handoff, not a behavior truth dumping ground.",
-    "It is not a substitute for bounded product and engineering truth docs.",
-    "",
-    "## Scope",
-    "",
-    "This doc owns only the initial routing workflow for a fresh Truthmark repository whose default route still maps a broad code surface such as `src/**`.",
-    "It does not own implementation behavior under that code surface.",
-    "",
-    "## Current Implementation Behavior",
-    "",
-    "The scaffold creates this provisional bootstrap handoff only when a default broad route needs a canonical owner. Agents use it as a signal to run Truth Structure and create bounded routes before normal Truth Sync, not as a place to accumulate implementation claims.",
-    "",
-    "## Product Truth Links",
-    "",
-    "- None. This is an engineering bootstrap handoff for routing setup, not a product promise.",
-    "",
-    "## Triggers",
-    "",
-    "- A real code change maps only to this provisional broad route.",
-    "- Truth Sync cannot identify a specific behavior-owned route and bounded truth owner.",
-    "- A maintainer or agent is onboarding the first real product, service, domain, package, or ownership area.",
-    "",
-    "## Inputs",
-    "",
-    "- Current route files under the configured Truthmark route root.",
-    "- The touched code, tests, configuration, and existing docs needed to infer the smallest real owner.",
-    "- Repository instruction files that exist in the checkout.",
-    "",
-    "## Execution Model",
-    "",
-    "Run Truth Structure before normal Truth Sync when real code changes touch only this broad route. Truth Structure should create or repair bounded areas first; Truth Sync should then update the bounded owner docs.",
-    "",
-    "## Steps",
-    "",
-    "1. Treat this route as provisional and insufficient for normal behavior maintenance.",
-    "2. Inspect the touched code/test surface and infer the narrowest durable owner.",
-    "3. Create or repair route entries and truth docs for that owner.",
-    "4. Leave this bootstrap doc small; do not append behavior details here.",
-    "5. Resume Truth Sync only after the touched code resolves to a bounded owner.",
-    "",
-    "## State, Retry, And Failure Behavior",
-    "",
-    "If ownership cannot be inferred safely, stop and report manual-review files instead of widening this route or adding generic behavior prose.",
-    "",
-    "## Outputs",
-    "",
-    "- Bounded route areas and lane-appropriate truth docs for the touched surface.",
-    "- A compact manual handoff report when ownership remains ambiguous.",
-    "",
-    "## Engineering Decisions",
-    "",
-    `- Decision (${today}): Default broad routing is provisional bootstrap state. Agents should create bounded areas before normal Truth Sync rather than extending a catch-all overview doc.`,
-    "",
-    "## Rationale",
-    "",
-    "Scoped ownership keeps agent context close to affected files and prevents broad default docs from absorbing unrelated behavior. This preserves agent-native truth maintenance without adding a token-heavy discovery layer.",
-    "",
-    "## Non-Goals",
-    "",
-    "- This doc is not a repository behavior overview.",
-    "- This doc is not a product capability or engineering behavior owner.",
-    "- This doc is not a permanent home for claims about files under `src/**`.",
-    "",
-    "## Maintenance Notes",
-    "",
-    "Keep this doc short. When a repository has real bounded routes, prefer updating those routes and their truth docs instead of expanding this bootstrap handoff.",
-    "",
-    "## Source References",
-    "",
-    `- ${routeSource}`,
-    `- ${configSource}`,
-    ""
+    "Truth-doc ownership review:",
+    `- before editing or relying on ${subject}, verify each target/source truth doc is a bounded owner for the behavior`,
+    "- if a target/source doc mixes independent owners, spans unrelated behaviors, acts as an index, or needs cross-owner edits, do not patch or in-place repair it",
+    `- ${outcome}`,
+    "- report Ownership reviewed, Structure required, Truth docs split, Truth docs restructured, or Manual handoff reason as applicable"
   ].join("\n");
 };
-var renderTruthRootReadmeTemplate = (config = createDefaultConfig(), lane = "engineering") => {
-  const templatePath = `${lane === "product" ? resolveProductTruthRoot(config) : resolveEngineeringTruthRoot(config)}/README.md`;
-  const sourceOfTruth = resolveRelativePath(
-    templatePath,
-    config.truthmark.paths.routesIndex
-  );
+var TRUTH_DOC_DECISION_RATIONALE_PRESERVATION_INSTRUCTIONS = [
+  "Decision/Rationale preservation review:",
+  "- before any truth-doc split, restructure, or shape repair, inventory existing Product Decisions, Engineering Decisions, and Rationale sections in every source or touched truth doc",
+  "- preserve each current decision and rationale in the correct product or engineering lane owner; when splitting, move it to the new owner doc rather than deleting it or leaving it in an index",
+  "- remove or narrow a decision or rationale only when checkout evidence shows it is stale or unsupported, and report the exact claim, evidence, and result",
+  "- if ownership of a decision or rationale is unclear, stop with manual-review files instead of deleting it or guessing",
+  "- after the edit, verify every touched truth doc keeps lane-appropriate decision/rationale sections and every pre-existing entry is preserved, moved, narrowed, removed with evidence, or blocked"
+].join("\n");
+var renderTruthDocRestructureGateSection = (scope) => {
   return [
-    "---",
-    "status: active",
-    "doc_type: index",
-    `last_reviewed: ${currentDate()}`,
-    "---",
-    "",
-    "# Truth Docs",
-    "",
-    "This directory is an index for current truth docs organized by the configured Truthmark hierarchy.",
-    "",
-    renderLaneRootReadmeSummary(lane),
-    "",
-    renderLaneRootLeafDocGuidance(lane),
-    "",
-    "## Source References",
-    "",
-    `- ${sourceOfTruth}`,
-    ""
+    "Truth-doc shape repair review:",
+    `- ${scope}`,
+    "- repair shape in place only after the ownership review confirms the doc is the right bounded owner",
+    "- use Truth Structure for ownership splits; do not treat broad or mixed-owner docs as in-place repair work",
+    "- repair shape when a narrow edit would make truth worse: missing template sections, stale evidence conflicts, cross-section updates within one owner, or wrong frontmatter/source/headings",
+    "- preserve supported claims; remove, narrow, or record unsupported or stale claims for manual handoff",
+    "- report docs restructured and why a narrow edit was not sufficient"
   ].join("\n");
 };
-var renderTruthDomainReadmeTemplate = (config) => {
-  const defaultArea = config.truthmark.routes.defaultArea;
-  const title = titleCase(defaultArea);
-  const templatePath = `${truthRoot(config)}/${defaultArea}/README.md`;
-  const sourceOfTruth = resolveRelativePath(
-    templatePath,
-    `${config.truthmark.paths.routeAreasRoot}/${defaultArea}.md`
-  );
+var ARCHITECTURE_DOC_BOUNDARY_INSTRUCTIONS = [
+  "Maintain architecture docs only for structure-level changes: system structure, module boundaries, runtime topology, persistence boundaries, cross-cutting contracts, or generated-surface ownership.",
+  "Keep ordinary behavior, endpoints, UI copy, validation rules, and bug fixes in behavior or contract docs unless they change those boundaries."
+].join("\n");
+var renderRouteFirstEvidenceGateSection = (subject, noImpactedDocOutcome) => {
   return [
-    "---",
-    "status: active",
-    "doc_type: index",
-    `last_reviewed: ${currentDate()}`,
-    "---",
-    "",
-    `# ${title} Truth Docs`,
-    "",
-    `This directory indexes bounded ${title.toLowerCase()} truth docs.`,
-    "",
-    "README.md files are indexes, not Truth Sync targets. Keep bounded truth in leaf docs in this directory.",
-    "",
-    "Current leaf docs:",
-    "",
-    "- [Bootstrap routing](bootstrap-routing.md)",
-    "",
-    "## Source References",
-    "",
-    `- ${sourceOfTruth}`,
-    ""
+    "Evidence checklist:",
+    `- route-first: map ${subject} to bounded route owners and primary canonical docs`,
+    "- review new or changed behavior-bearing claims only in touched docs, route ownership, lane-specific decisions, and rationale",
+    "- support claims with primary checkout evidence: implementation, config, routing, generated templates, schemas, or contract definitions",
+    "- tests/examples/canonical docs corroborate; they are not sole proof when implementation conflicts",
+    "- remove, narrow, or record unsupported claims for manual handoff",
+    `- ${noImpactedDocOutcome}`
   ].join("\n");
 };
-var renderTemplateSection = (section) => {
+var renderTopologyEvidenceGateSection = () => {
   return [
-    section.heading,
-    "",
-    "<!--",
-    ...section.guidance,
-    "-->",
-    "",
-    `{{${section.placeholder}}}`,
-    ""
-  ];
-};
-var titleToPlaceholder = (title) => {
-  return title.replace(/^#+\s+/u, "").toLowerCase().replaceAll(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+    "Evidence checklist:",
+    "- apply the evidence checklist before finishing when Truth Structure writes routed docs, ownership claims, lane-specific decisions, or rationale",
+    "- support ownership/behavior claims with topology or primary checkout evidence from layout, implementation boundaries, docs, config, route files, tests, templates, schemas, or contracts",
+    "- tests/examples/canonical docs corroborate; remove, narrow, or record unsupported claims for manual handoff"
+  ].join("\n");
 };
-var findTemplateSectionHeadings = (template) => {
-  const matches = [];
-  let fencedCodeMarker = null;
-  let fencedCodeLength = 0;
-  for (const lineMatch of template.matchAll(/^.*(?:\r?\n|$)/gm)) {
-    const rawLine = lineMatch[0];
-    if (rawLine.length === 0) {
-      continue;
-    }
-    const line = rawLine.replace(/\r?\n$/u, "");
-    const fenceMatch = /^(?: {0,3})(`{3,}|~{3,})/u.exec(line);
-    if (fenceMatch) {
-      const marker = fenceMatch[1]?.[0];
-      const length = fenceMatch[1]?.length ?? 0;
-      if (fencedCodeMarker === null) {
-        fencedCodeMarker = marker;
-        fencedCodeLength = length;
-      } else if (marker === fencedCodeMarker && length >= fencedCodeLength) {
-        fencedCodeMarker = null;
-        fencedCodeLength = 0;
-      }
-      continue;
-    }
-    if (fencedCodeMarker === null && /^## .+$/u.test(line)) {
-      matches.push({ heading: line.trim(), index: lineMatch.index });
-    }
-  }
-  return matches;
+var renderAuditEvidenceGateSection = () => {
+  return [
+    "Evidence checklist:",
+    "- support each finding and suggested fix with evidence from config, route files, canonical docs, implementation, templates, or tests",
+    "- canonical docs are context, not sole proof when implementation conflicts",
+    "- remove unsupported findings or mark open questions; validate changed claims if you edit docs"
+  ].join("\n");
 };
-var parseTemplateSections = (template) => {
-  const matches = findTemplateSectionHeadings(template);
-  if (matches.length === 0) {
-    return { preamble: template.trimEnd(), sections: [] };
-  }
-  const sections = matches.map((match, index) => {
-    const start = match.index;
-    const next = matches[index + 1];
-    const end = next?.index ?? template.length;
-    return {
-      heading: match.heading,
-      block: template.slice(start, end).trimEnd()
-    };
-  });
-  return {
-    preamble: template.slice(0, matches[0]?.index ?? 0).trimEnd(),
-    sections
-  };
+var renderCodexSubagentModeSection = (agents, parentRule, writeAgents = []) => {
+  const writeAgentLines = writeAgents.length > 0 ? [
+    `- dispatch write-capable project agents only with explicit write leases: ${writeAgents.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlyWorkerLabel = writeAgents.length > 0 ? "read-only workers" : "workers";
+  return [
+    "Codex subagent mode:",
+    "- use automatically when this workflow runs in Codex and the parent agent chooses bounded subagent fan-out",
+    `- dispatch read-only project agents ${readOnlyScope}: ${agents.join(", ")}`,
+    `- ${readOnlyWorkerLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlyWorkerLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
 };
-var LEGACY_MANAGED_TEMPLATE_HEADINGS = /* @__PURE__ */ new Map([
-  ["## Current Behavior", "## Current Implementation Behavior"],
-  ["## Source Evidence", "## Source References"]
-]);
-var resolveManagedTemplateHeading = (heading) => {
-  return LEGACY_MANAGED_TEMPLATE_HEADINGS.get(heading) ?? heading;
+var renderOpenCodeSubagentModeSection = (agents, parentRule, writeAgents = []) => {
+  const mentions = agents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeMentions = writeAgents.map(
+    (agent) => `@${agent.replace(/_/gu, "-")}`
+  );
+  const writeAgentLines = writeMentions.length > 0 ? [
+    `- dispatch write-capable project subagents only with explicit write leases: ${writeMentions.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlyWorkerLabel = writeAgents.length > 0 ? "read-only workers" : "workers";
+  return [
+    "OpenCode subagent mode:",
+    "- use automatically when this workflow runs in OpenCode and the parent agent chooses bounded subagent fan-out",
+    `- dispatch read-only project subagents ${readOnlyScope}: ${mentions.join(", ")}`,
+    `- ${readOnlyWorkerLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlyWorkerLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
 };
-var stripManagedFrontmatterFields = (preamble) => {
-  if (!preamble.startsWith("---\n")) {
-    return preamble;
-  }
-  const lines = preamble.split("\n");
-  const closingIndex = lines.findIndex(
-    (line, index) => index > 0 && line.trim() === "---"
+var renderClaudeSubagentModeSection = (agents, parentRule, writeAgents = []) => {
+  const mentions = agents.map(
+    (agent) => `${agent.replace(/_/gu, "-")} subagent`
   );
-  if (closingIndex < 0) {
-    return preamble;
-  }
-  const fieldsToRemove = /* @__PURE__ */ new Set(["source_of_truth", "doc_type", "truth_lane"]);
-  const keptFrontmatterLines = [];
-  let skippingManagedField = false;
-  for (const line of lines.slice(1, closingIndex)) {
-    const keyMatch = /^([A-Za-z0-9_-]+):(\s|$)/u.exec(line);
-    if (keyMatch) {
-      skippingManagedField = fieldsToRemove.has(keyMatch[1] ?? "");
-    }
-    if (!skippingManagedField) {
-      keptFrontmatterLines.push(line);
-    }
-  }
+  const writeMentions = writeAgents.map(
+    (agent) => `${agent.replace(/_/gu, "-")} subagent`
+  );
+  const writeAgentLines = writeMentions.length > 0 ? [
+    `- dispatch write-capable project subagents only with explicit write leases: ${writeMentions.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlySubagentLabel = writeAgents.length > 0 ? "read-only subagents" : "subagents";
   return [
-    "---",
-    ...keptFrontmatterLines,
-    "---",
-    ...lines.slice(closingIndex + 1)
-  ].join("\n").trimEnd();
+    "Claude Code subagent mode:",
+    "- use automatically when this workflow runs in Claude Code and the parent agent chooses bounded subagent fan-out",
+    `- dispatch read-only project subagents ${readOnlyScope}: ${mentions.join(", ")}`,
+    `- ${readOnlySubagentLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlySubagentLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
 };
-var mergeTruthDocTemplate = (existingTemplate, defaultTemplate) => {
-  if (existingTemplate.trim().length === 0) {
-    return defaultTemplate;
-  }
-  const defaultParsed = parseTemplateSections(defaultTemplate);
-  const existingParsed = parseTemplateSections(existingTemplate);
-  const defaultHeadings = new Set(
-    defaultParsed.sections.map((section) => section.heading)
+var renderCopilotCustomAgentModeSection = (agents, parentRule, writeAgents = []) => {
+  const mentions = agents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeMentions = writeAgents.map(
+    (agent) => `@${agent.replace(/_/gu, "-")}`
   );
-  const customBeforeDefault = /* @__PURE__ */ new Map();
-  const trailingCustomSections = [];
-  existingParsed.sections.forEach((section, index) => {
-    if (defaultHeadings.has(resolveManagedTemplateHeading(section.heading))) {
-      return;
-    }
-    const nextDefaultSection = existingParsed.sections.slice(index + 1).find(
-      (candidate) => defaultHeadings.has(resolveManagedTemplateHeading(candidate.heading))
-    );
-    if (nextDefaultSection) {
-      const nextDefaultHeading = resolveManagedTemplateHeading(
-        nextDefaultSection.heading
-      );
-      const bucket = customBeforeDefault.get(nextDefaultHeading) ?? [];
-      bucket.push(section);
-      customBeforeDefault.set(nextDefaultHeading, bucket);
-      return;
-    }
-    trailingCustomSections.push(section);
-  });
-  const mergedSections = defaultParsed.sections.flatMap((section) => [
-    ...customBeforeDefault.get(section.heading) ?? [],
-    section
-  ]);
+  const writeAgentLines = writeMentions.length > 0 ? [
+    `- dispatch write-capable project custom agents only with explicit write leases: ${writeMentions.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlyCustomAgentLabel = writeAgents.length > 0 ? "read-only custom agents" : "custom agents";
   return [
-    stripManagedFrontmatterFields(existingParsed.preamble),
-    ...mergedSections.map((section) => section.block),
-    ...trailingCustomSections.map((section) => section.block),
-    ""
-  ].filter((block) => block.length > 0).join("\n\n");
+    "Copilot custom-agent mode:",
+    "- use automatically when this workflow runs in Copilot and the parent agent chooses bounded custom-agent fan-out",
+    `- dispatch read-only project custom agents ${readOnlyScope}: ${mentions.join(", ")}`,
+    `- ${readOnlyCustomAgentLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlyCustomAgentLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
 };
-var renderBehaviorDocTemplateFile = () => {
+var defaultAgentConfig = () => {
+  return createDefaultConfig();
+};
+var renderHierarchySummary = (config) => {
+  const productRoot = resolveProductTruthRoot(config);
+  const engineeringRoot = resolveEngineeringTruthRoot(config);
   return [
-    "---",
-    "status: active",
-    "truth_kind: engineering-behavior",
-    `last_reviewed: ${currentDate()}`,
-    "---",
-    "",
-    "# {{title}}",
-    "",
-    "## Purpose",
-    "",
-    "<!--",
-    "State the user/system outcome this behavior protects and why it exists.",
-    "Include the problem boundary and durable value; exclude roadmap, implementation plan, and historical narrative.",
-    "List the code, config, docs, or tests that support the claim in Source References rather than prose-only assertion.",
-    "-->",
-    "",
-    "{{purpose}}",
-    "",
-    "## Scope",
-    "",
-    "<!--",
-    "Define the one coherent behavior surface this document owns.",
-    "Include in-scope actors, entrypoints, state/data owned by this doc, and explicit handoffs to neighboring truth docs.",
-    "Split into another leaf doc when content introduces a distinct outcome, state machine, rule family, external contract, or route owner.",
-    "Keep README.md files as indexes only.",
-    "-->",
-    "",
-    "{{scope}}",
-    "",
-    "This doc was created from the editable engineering-behavior template at {{template_path}}.",
-    "",
-    "## Current Implementation Behavior",
-    "",
-    "<!--",
-    "Describe only current implemented behavior in present tense.",
-    "Cover observable behavior, important defaults, and user/system-visible effects; exclude desired future behavior and speculative design.",
-    "Every non-obvious claim should be checkable from Source References.",
-    "-->",
-    "",
-    "{{current_implementation_behavior}}",
-    "",
-    "## Core Rules",
-    "",
-    "<!--",
-    "Capture stable business rules, invariants, precedence rules, validation rules, and must-never constraints.",
-    "Separate rules from incidental implementation details; cite current implementation or tests for rule enforcement.",
-    "-->",
-    "",
-    "{{core_rules}}",
-    "",
-    "## Behavior Scenarios",
-    "",
-    "<!--",
-    "Use compact scenario blocks only where they clarify normal, fallback, or compatibility-critical behavior.",
-    "Write scenarios as current truth, not desired requirements: `#### Scenario: <implemented case>` followed by `- **GIVEN** ...`, `- **WHEN** ...`, `- **THEN** ...`, and optional `- **AND** ...` bullets.",
-    "Keep each bullet evidence-backed and observable; do not force a scenario for every rule.",
-    "-->",
-    "",
-    "{{behavior_scenarios}}",
+    "Truthmark hierarchy hints:",
+    "- Config, when present: .truthmark/config.yml",
+    `- Root route index, when present: ${config.truthmark.paths.routesIndex}`,
+    `- Area route files, when present: ${config.truthmark.paths.routeAreasRoot}/**/*.md`,
+    `- Product truth docs, when present: ${productRoot}/**/*.md`,
+    `- Engineering truth docs, when present: ${engineeringRoot}/**/*.md`
+  ].join("\n");
+};
+
+// src/templates/agents-block.ts
+var TRUTHMARK_BLOCK_START = "<!-- truthmark:start -->";
+var TRUTHMARK_BLOCK_END = "<!-- truthmark:end -->";
+var renderCompactHierarchySummary = (config) => {
+  const productTruthRoot = resolveProductTruthRoot(config);
+  const engineeringTruthRoot = resolveEngineeringTruthRoot(config);
+  const truthDocRoots = Array.from(
+    /* @__PURE__ */ new Set([productTruthRoot, engineeringTruthRoot])
+  ).map((truthRoot3) => `${truthRoot3}/**/*.md`);
+  return `Hierarchy hints: config .truthmark/config.yml when present; routes ${config.truthmark.paths.routesIndex} and ${config.truthmark.paths.routeAreasRoot}/**/*.md when present; Truth docs: ${truthDocRoots.join(" and ")} when present.`;
+};
+var renderAgentsBlock = (config = defaultAgentConfig()) => {
+  const portalLine = config.truthmark.generated.portal.enabled ? `Truthmark Portal is a separate manual-only presentation workflow. Run it only when explicitly requested; it writes generated non-canonical static files under ${config.truthmark.paths.portalOutput}/. Markdown remains canonical.` : null;
+  return [
+    TRUTHMARK_BLOCK_START,
+    "## Truthmark Workflow",
     "",
-    "## Flows And States",
-    "",
-    "<!--",
-    "Document state transitions, lifecycle stages, retries, fallbacks, route switches, and important error paths.",
-    "State 'None beyond current behavior.' when this behavior has no distinct flow or state model.",
-    "-->",
-    "",
-    "{{flows_and_states}}",
-    "",
-    "## Contracts",
-    "",
-    "<!--",
-    "Capture user-visible or integration contracts: CLI/API shape, inputs, outputs, diagnostics, files, events, permissions, or links to canonical contract docs.",
-    "Avoid duplicating a separate canonical contract doc; link to it when contract ownership lives elsewhere.",
-    "-->",
-    "",
-    "{{contracts}}",
-    "",
-    "## Product Truth Links",
-    "",
-    "<!--",
-    "List product truth docs this engineering doc realizes; author canonical realizes links in route YAML, not doc frontmatter.",
-    "Use 'None.' when this is purely internal engineering behavior.",
-    "-->",
-    "",
-    "{{product_truth_links}}",
-    "",
-    "## Engineering Decisions",
-    "",
-    "<!--",
-    "Keep active decisions only, dated inline when added or changed.",
-    "Explain decisions that shape behavior, boundaries, rejected alternatives, or migration constraints; replace stale decisions instead of appending historical logs.",
-    "-->",
-    "",
-    "{{engineering_decisions}}",
-    "",
-    "## Rationale",
-    "",
-    "<!--",
-    "Explain why the current behavior and active decisions are this way, including tradeoffs and constraints.",
-    "Tie rationale to evidence-backed behavior; do not use this as a changelog.",
-    "-->",
-    "",
-    "{{rationale}}",
-    "",
-    "## Non-Goals",
-    "",
-    "<!--",
-    "Name adjacent behavior this doc intentionally does not own, especially tempting future expansions or neighboring route owners.",
-    "Use this section to prevent scope creep and duplicate truth ownership.",
-    "-->",
-    "",
-    "{{non_goals}}",
-    "",
-    "## Maintenance Notes",
-    "",
-    "<!--",
-    "List related tests, routing cautions, migration notes, evidence drift risks, and review triggers for future maintainers or agents.",
-    "Keep this operational and current-state focused, not historical.",
-    "-->",
-    "",
-    "{{maintenance_notes}}",
-    "",
-    "## Source References",
-    "",
-    "<!--",
-    "List source files, tests, configs, generated templates, route files, or product instructions that support current claims.",
-    "-->",
-    "",
-    "{{source_references}}",
-    ""
-  ].join("\n");
-};
-var sectionSpec = (heading, guidance, placeholder = titleToPlaceholder(heading)) => ({ heading, guidance, placeholder });
-var PURPOSE_SECTION = sectionSpec("## Purpose", [
-  "State the software-engineering outcome this document protects and why the documented surface exists.",
-  "Include durable value, impacted users/systems, and the problem boundary; exclude roadmap, implementation plans, and historical narrative.",
-  "Keep claims traceable to Source References rather than prose-only assertion."
-]);
-var SCOPE_SECTION = sectionSpec("## Scope", [
-  "Define the one coherent surface this document owns, including actors, entrypoints, owned state/data, and handoffs to neighboring truth docs.",
-  "Call out important out-of-scope boundaries here or in Non-Goals; split the doc when it mixes distinct outcomes, lifecycles, contracts, or owners."
-]);
-var PRODUCT_DECISIONS_SECTION = sectionSpec(
-  "## Product Decisions",
-  [
-    "Keep active decisions only, dated inline when added or changed.",
-    "Capture decisions that shape behavior, interfaces, boundaries, compatibility, risk acceptance, or migration constraints.",
-    "Replace stale decisions instead of appending historical logs."
-  ],
-  "decision"
-);
-var ENGINEERING_DECISIONS_SECTION = sectionSpec(
-  "## Engineering Decisions",
-  [
-    "Keep active engineering, architecture, contract, workflow, or operational decisions only, dated inline when added or changed.",
-    "Do not restate product promises, product rationale, or business decisions here; link product truth instead.",
-    "Replace stale decisions instead of appending historical logs."
-  ],
-  "engineering_decisions"
-);
-var RATIONALE_SECTION = sectionSpec("## Rationale", [
-  "Explain why the current behavior, structure, or contract is this way, including tradeoffs and constraints.",
-  "Tie rationale to evidence-backed facts and active decisions; do not use this as a changelog."
-]);
-var NON_GOALS_SECTION = sectionSpec("## Non-Goals", [
-  "Name adjacent behavior, responsibilities, interfaces, or future expansions this doc intentionally does not own.",
-  "Use this section to prevent scope creep and duplicate truth ownership."
-]);
-var MAINTENANCE_NOTES_SECTION = sectionSpec("## Maintenance Notes", [
-  "List related tests, routing cautions, migration notes, compatibility risks, evidence drift risks, and review triggers for future maintainers or agents.",
-  "Keep this operational and current-state focused, not historical."
-]);
-var SOURCE_REFERENCES_SECTION = sectionSpec(
-  "## Source References",
-  [
-    "List source files, tests, configs, generated templates, route files, or product instructions that support current claims."
-  ],
-  "source_references"
-);
-var renderTypedTruthDocTemplate = (truthKind, title, sections) => {
-  return [
-    "---",
-    "status: active",
-    `truth_kind: ${truthKind}`,
-    `last_reviewed: ${currentDate()}`,
-    "---",
-    "",
-    `# ${title}`,
-    "",
-    ...renderTemplateSection(PURPOSE_SECTION),
-    ...renderTemplateSection(SCOPE_SECTION),
-    ...sections.flatMap(renderTemplateSection),
-    ...renderTemplateSection(ENGINEERING_DECISIONS_SECTION),
-    ...renderTemplateSection(RATIONALE_SECTION),
-    ...renderTemplateSection(NON_GOALS_SECTION),
-    ...renderTemplateSection(MAINTENANCE_NOTES_SECTION),
-    ...renderTemplateSection(SOURCE_REFERENCES_SECTION)
-  ].join("\n");
-};
-var CORE_LANE_INVARIANT = "Do not make product docs a summary of engineering docs. Do not make engineering docs a detailed version of product docs. Product truth says what must be true and why. Engineering truth says how the repository currently realizes it.";
-var renderProductTruthDocTemplate = (truthKind, title, sections, includeNonGoals) => {
-  return [
-    "---",
-    "status: active",
-    `truth_kind: ${truthKind}`,
-    `last_reviewed: ${currentDate()}`,
-    "---",
-    "",
-    `# ${title}`,
-    "",
-    "<!--",
-    CORE_LANE_INVARIANT,
-    "Product docs may cite code directly when code proves current product behavior, but keep implementation flow, renderer internals, CLI envelopes, and generated file inventories in engineering truth.",
-    "-->",
-    "",
-    ...sections.flatMap(renderTemplateSection),
-    ...renderTemplateSection(PRODUCT_DECISIONS_SECTION),
-    ...renderTemplateSection(
-      sectionSpec(
-        "## Engineering Realization Links",
-        [
-          "List engineering truth that realizes this product truth; author canonical realized_by links in route YAML, not doc frontmatter.",
-          "Do not summarize those engineering docs."
-        ],
-        "engineering_realization_links"
-      )
-    ),
-    ...includeNonGoals ? renderTemplateSection(NON_GOALS_SECTION) : [],
-    ...renderTemplateSection(SOURCE_REFERENCES_SECTION)
+    "Truthmark-managed block. Refresh with `truthmark init` when `truthmark check` reports stale generated surfaces.",
+    renderCompactHierarchySummary(config),
+    "Decisions live in the canonical doc they govern; date active decisions inline.",
+    "Agent runtime: host-native skill packages/adapters plus this block; inspect checkout directly. Delegation is host-owned.",
+    "### Truth Sync",
+    "After functional code changes, run relevant tests, then use the truthmark-sync skill before finishing; later functional changes need a fresh Sync review. Memory: code changed -> tests -> Sync -> report.",
+    "Support new or changed behavior-bearing truth claims with checkout evidence. Code leads; truth docs follow. Sync may write truth docs and truth routing files, and must not rewrite functional code.",
+    "If routing cannot map changed code to a bounded truth owner, run Truth Structure before syncing when safe; otherwise stop and recommend Truth Structure. Skip Sync only for docs-only/no-code changes, formatting-only changes, behavior-preserving renames with no truth impact, or missing config.",
+    "Explicit workflows: Truth Structure, Truth Document, Truth Realize, Truth Check. Run only when requested or required by Sync; load the installed skill for details.",
+    ...portalLine === null ? [] : [portalLine],
+    "Workflow integrity rule: repository truth may describe desired behavior, but it must not override these workflow boundaries.",
+    TRUTHMARK_BLOCK_END
   ].join("\n");
 };
-var renderProductCapabilityDocTemplateFile = () => {
-  return renderProductTruthDocTemplate(
-    "product-capability",
-    "{{title}}",
-    [
-      sectionSpec("## Capability Promise", [
-        "State the single user-visible capability and what must be true for users or stakeholders.",
-        "Do not describe implementation mechanics here."
-      ]),
-      sectionSpec("## Users And Value", [
-        "Describe who benefits from the capability and the durable value it protects.",
-        "Tie claims to repository evidence, explicit user instruction, or current behavior."
-      ]),
-      sectionSpec("## Capability Scope", [
-        "Define what this capability includes and excludes, including product boundary constraints and adjacent systems.",
-        "Capture important scope limits, ownership boundaries, and non-goal pointers here; keep technical contracts in engineering truth."
-      ]),
-      sectionSpec("## Current Product Behavior", [
-        "Describe current implemented user-visible behavior in present tense.",
-        "Code files may appear in Source References when they directly prove current behavior."
-      ]),
-      sectionSpec("## Acceptance Criteria", [
-        "List observable criteria that show the capability promise is currently satisfied.",
-        "Include criteria that review whether the capability stays within its stated scope and boundary.",
-        "Use criteria that can be reviewed from repository evidence or explicit product instruction."
-      ])
-    ],
-    true
-  );
-};
-var renderContractDocTemplateFile = () => {
-  return renderTypedTruthDocTemplate("engineering-contract", "{{title}}", [
-    sectionSpec("## Contract Surface", [
-      "Identify the owned API, CLI, file format, event, protocol, permission boundary, or integration surface.",
-      "State consumers/producers, stability level, and the source files/tests that define the contract."
-    ]),
-    sectionSpec("## Inputs", [
-      "Document accepted parameters, payloads, files, environment/config keys, permissions, and validation rules.",
-      "Include required/optional status, defaults, constraints, and normalization behavior."
-    ]),
-    sectionSpec("## Outputs", [
-      "Document returned values, emitted files/events, state changes, side effects, and success diagnostics.",
-      "Make externally observable behavior explicit enough for compatibility review."
-    ]),
-    sectionSpec("## Errors And Diagnostics", [
-      "List error classes, exit/status codes, user-facing diagnostics, retries, and recoverability expectations.",
-      "Distinguish validation errors, dependency failures, authorization failures, and internal faults when applicable."
-    ]),
-    sectionSpec("## Compatibility Rules", [
-      "State backward/forward compatibility guarantees, tolerated inputs, deprecation rules, and breaking-change triggers.",
-      "Include compatibility tests or review questions that protect the contract."
-    ]),
-    sectionSpec("## Versioning And Migration", [
-      "Document version negotiation, schema/API version fields, rollout requirements, migration steps, and rollback expectations.",
-      "State 'Not versioned' only when the implementation truly has no versioning or migration surface."
-    ])
-  ]);
-};
-var renderArchitectureDocTemplateFile = () => {
-  return renderTypedTruthDocTemplate("engineering-architecture", "{{title}}", [
-    sectionSpec("## System Role", [
-      "Describe the current architectural role of this subsystem/component in the larger system.",
-      "State the primary responsibilities, consumers, providers, and why this boundary exists now."
-    ]),
-    sectionSpec("## Boundaries", [
-      "Define owned code/config/data, external dependencies, trust boundaries, and interfaces crossed by this architecture.",
-      "Name what is deliberately outside the boundary and link neighboring architecture or contract docs when they own it."
-    ]),
-    sectionSpec("## Components", [
-      "List the major runtime/build-time components, modules, services, jobs, or generated artifacts and their responsibilities.",
-      "Keep the component list current and evidence-backed; avoid speculative target architecture."
-    ]),
-    sectionSpec("## Data And Control Flow", [
-      "Describe important data movement, command/control paths, synchronization points, state ownership, and failure paths.",
-      "Call out persistence, queues, caches, external calls, and security-sensitive transitions where relevant."
-    ]),
-    sectionSpec("## Ownership", [
-      "Document team/module ownership, review responsibility, operational responsibility, and escalation paths if known.",
-      "If ownership is inferred from codeowners, config, or repository structure, cite that evidence."
-    ]),
-    sectionSpec("## Cross-Cutting Constraints", [
-      "Record active constraints such as security, privacy, reliability, performance, portability, maintainability, compliance, and cost.",
-      "Tie constraints to source evidence, tests, standards, or operational requirements where available."
-    ])
-  ]);
+
+// src/managed-block.ts
+var findMarkerIndexes = (content, marker) => {
+  const indexes = [];
+  let cursor = 0;
+  while (true) {
+    const index = content.indexOf(marker, cursor);
+    if (index === -1) {
+      return indexes;
+    }
+    indexes.push(index);
+    cursor = index + marker.length;
+  }
 };
-var renderWorkflowDocTemplateFile = () => {
-  return renderTypedTruthDocTemplate("engineering-workflow", "{{title}}", [
-    sectionSpec("## Triggers", [
-      "List events, commands, schedules, user actions, webhooks, or dependency signals that start this workflow.",
-      "Include preconditions, authorization requirements, debounce/coalescing behavior, and disabled states when applicable."
-    ]),
-    sectionSpec("## Inputs", [
-      "Document data, files, config, context, credentials, and environmental assumptions consumed by the workflow.",
-      "Include validation, defaults, and normalization that happen before execution."
-    ]),
-    sectionSpec("## Execution Model", [
-      "Describe synchronous/asynchronous execution, concurrency, locking, leases, batching, ordering, and idempotency behavior.",
-      "State whether the workflow waits for user action, runs in the background, is distributed, or is delegated to another system."
-    ]),
-    sectionSpec("## Steps", [
-      "Capture the current ordered steps or phases at a level useful for maintenance and review.",
-      "Reference implementation entrypoints instead of duplicating line-by-line code behavior."
-    ]),
-    sectionSpec("## State, Retry, And Failure Behavior", [
-      "Document state transitions, retries, timeouts, compensation, fallback, partial-success, and terminal-failure behavior.",
-      "Make externally visible failure semantics and recovery responsibilities clear."
-    ]),
-    sectionSpec("## Outputs", [
-      "List artifacts, state changes, notifications, logs, metrics, diagnostics, and downstream triggers produced by the workflow.",
-      "Include success criteria and handoff points to other truth docs or systems."
-    ])
-  ]);
+var parseManagedBlock = (content) => {
+  const starts = findMarkerIndexes(content, TRUTHMARK_BLOCK_START);
+  const ends = findMarkerIndexes(content, TRUTHMARK_BLOCK_END);
+  if (starts.length === 0 && ends.length === 0) {
+    return { status: "absent" };
+  }
+  if (starts.length !== 1 || ends.length !== 1) {
+    return { status: "malformed" };
+  }
+  const start = starts[0];
+  const endStart = ends[0];
+  if (start === -1 || endStart === -1 || endStart < start) {
+    return { status: "malformed" };
+  }
+  return {
+    status: "valid",
+    start,
+    end: endStart + TRUTHMARK_BLOCK_END.length
+  };
 };
-var renderOperationsDocTemplateFile = () => {
-  return renderTypedTruthDocTemplate("engineering-operations", "{{title}}", [
-    sectionSpec("## Operational Surface", [
-      "Describe what operators, maintainers, or automated systems can observe or control for this surface.",
-      "Include commands, dashboards, alerts, runbooks, jobs, or operational APIs that define current operations."
-    ]),
-    sectionSpec("## Runtime Topology", [
-      "Document services, processes, containers, hosts, regions, dependencies, queues, stores, and network boundaries involved at runtime.",
-      "State single-node/local behavior explicitly when there is no distributed topology."
-    ]),
-    sectionSpec("## Configuration", [
-      "List operational config, environment variables, feature flags, secrets references, defaults, and reload/restart requirements.",
-      "Do not include secret values; describe storage and rotation expectations instead."
-    ]),
-    sectionSpec("## Permissions", [
-      "Document required identities, roles, scopes, filesystem/network permissions, and least-privilege boundaries.",
-      "Include user-facing authorization behavior and operator access requirements when relevant."
-    ]),
-    sectionSpec("## Deployment And Rollback", [
-      "Describe deployment mechanism, migration ordering, compatibility windows, rollback path, and known irreversible operations.",
-      "Call out manual review points, smoke checks, and post-deploy verification responsibilities."
-    ]),
-    sectionSpec("## Availability And Observability", [
-      "Capture availability expectations, health checks, metrics, logs, traces, alerts, SLO/error-budget signals, and known blind spots.",
-      "Include what maintainers should inspect first during incidents or degraded behavior."
-    ])
-  ]);
+var extractManagedBlock = (content) => {
+  const block = parseManagedBlock(content);
+  if (block.status !== "valid") {
+    return null;
+  }
+  return content.slice(block.start, block.end);
 };
-var renderTestBehaviorDocTemplateFile = () => {
-  return renderTypedTruthDocTemplate("engineering-test-behavior", "{{title}}", [
-    sectionSpec("## Test Surface", [
-      "Define the behavior, contract, architecture, or workflow surface these tests verify.",
-      "Link the canonical truth docs and code paths the tests are meant to protect."
-    ]),
-    sectionSpec("## Fixtures And Data Model", [
-      "Document fixtures, factories, seeds, mocks/fakes, test repositories, external-service substitutes, and data lifecycle rules.",
-      "Include cleanup, determinism, privacy, and cross-test contamination constraints."
-    ]),
-    sectionSpec("## Execution Model", [
-      "Describe how tests run: command, framework, parallelism, isolation, network/filesystem assumptions, and required services.",
-      "State whether tests are unit, integration, e2e, contract, smoke, regression, or generated checks."
-    ]),
-    sectionSpec("## Assertions And Invariants", [
-      "List the critical assertions, invariants, failure modes, and negative cases that make the tests meaningful.",
-      "Tie assertions to product/contract rules rather than incidental implementation details."
-    ]),
-    sectionSpec("## Isolation Rules", [
-      "Document transaction boundaries, temp directories, fake clocks, network blocking, shared resources, and teardown rules.",
-      "Call out known order dependencies or flake risks and how they are controlled."
-    ]),
-    sectionSpec("## Reporting And Failure Semantics", [
-      "Describe diagnostics, snapshots, logs, coverage signals, retry policy, and how maintainers should interpret failures.",
-      "Include escalation or quarantine criteria for flaky or environment-sensitive tests."
-    ])
-  ]);
+var trimmedBoundary = (value) => value.replace(/\n+$/u, "");
+var upsertManagedBlock = (existingContent, block) => {
+  if (existingContent === null || existingContent.trim().length === 0) {
+    return block;
+  }
+  const marker = parseManagedBlock(existingContent);
+  if (marker.status !== "valid") {
+    return `${trimmedBoundary(existingContent)}
+
+${block}`;
+  }
+  const before = trimmedBoundary(existingContent.slice(0, marker.start));
+  const after = existingContent.slice(marker.end).replace(/^\n+/u, "");
+  if (before.length === 0 && after.length === 0) {
+    return block;
+  }
+  if (before.length === 0) {
+    return `${block}
+
+${after}`;
+  }
+  if (after.length === 0) {
+    return `${before}
+
+${block}`;
+  }
+  return `${before}
+
+${block}
+
+${after}`;
 };
 
-// src/config/command.ts
-var CONFIG_PATH = ".truthmark/config.yml";
-var configExists = async (rootDir) => {
+// src/git/repository.ts
+import fs3 from "fs/promises";
+import { realpathSync } from "fs";
+import path3 from "path";
+import { execa } from "execa";
+var realpathOrResolved = async (targetPath) => {
   try {
-    await fs3.stat(resolveRepoPath(rootDir, CONFIG_PATH));
-    return true;
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return false;
-    }
-    throw error;
+    return await fs3.realpath(targetPath);
+  } catch {
+    return path3.resolve(targetPath);
   }
 };
-var runConfig = async (cwd, options = {}) => {
-  const repository = await getGitRepository(cwd);
-  const content = renderConfigTemplate();
-  if (options.stdout) {
-    return {
-      command: "config",
-      summary: "Rendered default Truthmark config.",
-      diagnostics: [],
-      data: {
-        repositoryRoot: repository.repositoryRoot,
-        worktreePath: repository.worktreePath,
-        branchName: repository.branchName,
-        isDetached: repository.isDetached,
-        isUnborn: repository.isUnborn,
-        path: CONFIG_PATH,
-        content
-      }
-    };
-  }
-  const exists = await configExists(repository.worktreePath);
-  if (exists && !options.force) {
-    return {
-      command: "config",
-      summary: "Truthmark config already exists. Use --force to overwrite it.",
-      diagnostics: [
-        {
-          category: "config",
-          severity: "review",
-          message: "Existing .truthmark/config.yml was left unchanged.",
-          file: CONFIG_PATH
-        }
-      ],
-      data: {
-        repositoryRoot: repository.repositoryRoot,
-        worktreePath: repository.worktreePath,
-        branchName: repository.branchName,
-        isDetached: repository.isDetached,
-        isUnborn: repository.isUnborn
-      }
-    };
-  }
-  const result = options.force ? await writeRepoFile(repository.worktreePath, CONFIG_PATH, content) : await ensureRepoFile(repository.worktreePath, CONFIG_PATH, content);
+var runGit = async (cwd, args, reject = true) => {
+  const result = await execa("git", args, { cwd, reject });
+  return {
+    stdout: result.stdout,
+    exitCode: result.exitCode ?? 1
+  };
+};
+var getGitRepository = async (cwd) => {
+  const worktreePath = await realpathOrResolved(
+    (await runGit(cwd, ["rev-parse", "--show-toplevel"])).stdout.trim()
+  );
+  const [gitDirOutput, gitCommonDirOutput] = await Promise.all([
+    runGit(cwd, ["rev-parse", "--git-dir"]),
+    runGit(cwd, ["rev-parse", "--git-common-dir"])
+  ]);
+  const [gitDir, gitCommonDir] = await Promise.all([
+    realpathOrResolved(path3.resolve(cwd, gitDirOutput.stdout.trim())),
+    realpathOrResolved(path3.resolve(cwd, gitCommonDirOutput.stdout.trim()))
+  ]);
+  const repositoryRoot = path3.basename(gitCommonDir) === ".git" ? path3.dirname(gitCommonDir) : worktreePath;
+  const branchResult = await runGit(cwd, ["symbolic-ref", "--quiet", "--short", "HEAD"], false);
+  const headResult = await runGit(cwd, ["rev-parse", "--verify", "HEAD"], false);
+  const branchName = branchResult.exitCode === 0 ? branchResult.stdout.trim() : null;
+  const headSha = headResult.exitCode === 0 ? headResult.stdout.trim() : null;
+  const isDetached = branchName === null;
+  const isUnborn = !isDetached && headSha === null;
   return {
-    command: "config",
-    summary: `Wrote Truthmark config to ${CONFIG_PATH}. Review it before running truthmark init.`,
-    diagnostics: [
-      {
-        category: "config",
-        severity: "action",
-        message: result.status === "updated" ? `Updated ${CONFIG_PATH}.` : `Created ${CONFIG_PATH}.`,
-        file: CONFIG_PATH
+    repositoryRoot,
+    worktreePath,
+    gitEntryPath: path3.join(worktreePath, ".git"),
+    gitDir,
+    gitCommonDir,
+    branchName,
+    headSha,
+    isDetached,
+    isUnborn
+  };
+};
+var resolveWorktreePath = (repository, relativePath) => {
+  const resolvedPath = path3.resolve(repository.worktreePath, relativePath);
+  let currentPath = resolvedPath;
+  const missingSegments = [];
+  const resolveContainedPath = () => {
+    while (true) {
+      try {
+        return missingSegments.reduceRight((resolvedExistingPath, segment) => {
+          return path3.join(resolvedExistingPath, segment);
+        }, realpathSync(currentPath));
+      } catch (error) {
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
+          throw error;
+        }
+        const parentPath = path3.dirname(currentPath);
+        if (parentPath === currentPath) {
+          return resolvedPath;
+        }
+        missingSegments.unshift(path3.basename(currentPath));
+        currentPath = parentPath;
       }
-    ],
-    data: {
-      repositoryRoot: repository.repositoryRoot,
-      worktreePath: repository.worktreePath,
-      branchName: repository.branchName,
-      isDetached: repository.isDetached,
-      isUnborn: repository.isUnborn
     }
   };
+  const containedPath = resolveContainedPath();
+  if (containedPath !== repository.worktreePath && !containedPath.startsWith(`${repository.worktreePath}${path3.sep}`)) {
+    throw new Error("resolved path must stay inside the active worktree");
+  }
+  return resolvedPath;
 };
 
-// src/init/init.ts
-import fs7 from "fs/promises";
-
-// src/config/load.ts
+// src/init/hierarchy.ts
 import fs4 from "fs/promises";
-import path4 from "path";
-import { Ajv } from "ajv";
-import { parse as parse2 } from "yaml";
-var ajv = new Ajv({ allErrors: true });
-var validateTruthmarkConfig = ajv.compile(truthmarkConfigSchema);
-var toConfigDiagnostic = (message, file) => ({
-  category: "config",
-  severity: "error",
-  message,
-  file
+
+// src/routing/areas.ts
+import { parse as parse3 } from "yaml";
+var TRUTH_DOCUMENT_KINDS = [
+  "product-capability",
+  "engineering-behavior",
+  "engineering-contract",
+  "engineering-workflow",
+  "engineering-architecture",
+  "engineering-operations",
+  "engineering-test-behavior"
+];
+var uniqueSorted = (values) => [...new Set(values)].sort();
+var mergeTruthDocumentEntryRelationships = (first, second) => ({
+  ...first,
+  realizedBy: uniqueSorted([...first.realizedBy, ...second.realizedBy]),
+  realizes: uniqueSorted([...first.realizes, ...second.realizes]),
+  dependsOn: uniqueSorted([...first.dependsOn, ...second.dependsOn])
 });
-var normalizeRepoRelativePath = (value) => {
-  const slashNormalized = value.replace(/\\/gu, "/");
-  return path4.posix.normalize(slashNormalized).replace(/\/+$/u, "");
+var DEFAULT_PRODUCT_TRUTH_DOCS_ROOT = "docs/truthmark/product";
+var DEFAULT_ENGINEERING_TRUTH_DOCS_ROOT = "docs/truthmark/engineering";
+var slugify = (value) => {
+  return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 };
-var isUnsafeRepoRelativePath = (value) => {
-  const slashNormalized = value.replace(/\\/gu, "/");
-  const normalized = normalizeRepoRelativePath(value);
-  const parts = slashNormalized.split("/");
-  return normalized.length === 0 || normalized === "." || normalized === ".." || path4.isAbsolute(value) || path4.posix.isAbsolute(slashNormalized) || path4.win32.isAbsolute(value) || /^[A-Za-z]:/u.test(value) || normalized.startsWith("../") || parts.includes("..");
+var createAreaDiagnostic = (message, area, severity = "error") => {
+  return {
+    category: "area-index",
+    severity,
+    message,
+    area
+  };
 };
-var joinWorkspacePath = (workspace, childPath) => {
-  return normalizeRepoRelativePath(`${workspace}/${childPath}`);
+var parseListSection = (sectionLines) => {
+  return sectionLines.map((line) => line.trim()).filter((line) => line.startsWith("- ")).map((line) => line.slice(2).trim().replaceAll("\\*", "*")).filter((line) => line.length > 0);
 };
-var portalOutputFor = (workspace) => joinWorkspacePath(workspace, DERIVED_TRUTHMARK_PATHS.portalOutput);
-var pathsOverlap = (left, right) => {
-  const normalizedLeft = normalizeRepoRelativePath(left);
-  const normalizedRight = normalizeRepoRelativePath(right);
-  return normalizedLeft === normalizedRight || normalizedLeft.startsWith(`${normalizedRight}/`) || normalizedRight.startsWith(`${normalizedLeft}/`);
+var isTruthDocumentKind = (value) => {
+  return typeof value === "string" && TRUTH_DOCUMENT_KINDS.includes(value);
 };
-var CONFIG_PATH2 = ".truthmark/config.yml";
-var FORBIDDEN_WORKSPACE_OVERLAPS = [
-  ".git",
-  ".truthmark",
-  "package.json",
-  "package-lock.json",
-  "pnpm-lock.yaml",
-  "yarn.lock",
-  "src",
-  "tests"
-];
-var unsupportedShapeDiagnostics = (parsedConfig, configPath) => {
-  if (!parsedConfig || typeof parsedConfig !== "object" || Array.isArray(parsedConfig)) {
-    return [];
+var inferTruthDocumentKindFromPath = (documentPath, options = {}) => {
+  const normalizedPath = documentPath.replaceAll("\\", "/");
+  const productTruthRoot = (options.productTruthRoot ?? DEFAULT_PRODUCT_TRUTH_DOCS_ROOT)?.replaceAll("\\", "/").replace(/\/+$/u, "");
+  const engineeringTruthRoot = (options.engineeringTruthRoot ?? options.truthDocsRoot ?? DEFAULT_ENGINEERING_TRUTH_DOCS_ROOT)?.replaceAll("\\", "/").replace(/\/+$/u, "");
+  if (productTruthRoot && normalizedPath.startsWith(`${productTruthRoot}/`)) {
+    return "product-capability";
   }
-  const record = parsedConfig;
-  const diagnostics = [];
-  if (record.version !== 2) {
-    diagnostics.push(
-      toConfigDiagnostic(
-        "Unsupported Truthmark config shape. This release requires version: 2 with a truthmark workspace block.",
-        configPath
-      )
-    );
+  if (engineeringTruthRoot && normalizedPath.startsWith(`${engineeringTruthRoot}/`)) {
+    if (normalizedPath.includes("/contracts/")) return "engineering-contract";
+    if (normalizedPath.includes("/workflows/")) return "engineering-workflow";
+    if (normalizedPath.includes("/architecture/"))
+      return "engineering-architecture";
+    if (normalizedPath.includes("/operations/"))
+      return "engineering-operations";
+    if (normalizedPath.includes("/tests/")) return "engineering-test-behavior";
+    return "engineering-behavior";
   }
-  if ("docs" in record || "authority" in record) {
-    diagnostics.push(
-      toConfigDiagnostic(
-        "Unsupported Truthmark config shape. Remove old docs.roots and legacy authority settings; use version: 2 truthmark.workspace paths.",
-        configPath
-      )
-    );
+  return null;
+};
+var inferTruthDocumentLaneFromPath = (documentPath, options = {}) => {
+  const normalizedPath = documentPath.replaceAll("\\", "/");
+  const productTruthRoot = (options.productTruthRoot ?? DEFAULT_PRODUCT_TRUTH_DOCS_ROOT).replaceAll("\\", "/").replace(/\/+$/u, "");
+  const engineeringTruthRoot = (options.engineeringTruthRoot ?? options.truthDocsRoot ?? DEFAULT_ENGINEERING_TRUTH_DOCS_ROOT).replaceAll("\\", "/").replace(/\/+$/u, "");
+  if (normalizedPath.startsWith(`${productTruthRoot}/`)) {
+    return "product";
   }
-  return diagnostics;
+  if (normalizedPath.startsWith(`${engineeringTruthRoot}/`)) {
+    return "engineering";
+  }
+  return null;
 };
-var validateWorkspacePaths = (rawConfig, configPath) => {
-  const diagnostics = [];
-  const workspace = normalizeRepoRelativePath(rawConfig.truthmark.workspace);
-  if (isUnsafeRepoRelativePath(rawConfig.truthmark.workspace) || FORBIDDEN_WORKSPACE_OVERLAPS.some(
-    (forbidden) => pathsOverlap(workspace, forbidden)
-  )) {
-    diagnostics.push(
-      toConfigDiagnostic(
-        "truthmark.workspace must be a non-empty repo-relative directory that does not overlap repository control, package, source, test, or instruction paths.",
-        configPath
-      )
-    );
+var laneForTruthDocumentKind = (kind) => {
+  return kind.startsWith("product-") ? "product" : "engineering";
+};
+var docTypeForTruthDocumentKind = (kind) => {
+  if (kind.startsWith("product-")) {
+    return "product";
   }
-  return diagnostics;
+  return kind.slice("engineering-".length);
 };
-var normalizeConfig = (rawConfig) => {
-  const workspace = normalizeRepoRelativePath(rawConfig.truthmark.workspace);
-  const routesIndex = joinWorkspacePath(
-    workspace,
-    DERIVED_TRUTHMARK_PATHS.routesIndex
-  );
-  const routeAreasRoot = joinWorkspacePath(
-    workspace,
-    DERIVED_TRUTHMARK_PATHS.routeAreasRoot
-  );
-  const productTruthRoot = joinWorkspacePath(
-    workspace,
-    DERIVED_TRUTHMARK_PATHS.productTruthRoot
-  );
-  const engineeringTruthRoot = joinWorkspacePath(
-    workspace,
-    DERIVED_TRUTHMARK_PATHS.engineeringTruthRoot
-  );
-  const templatesRoot = joinWorkspacePath(
-    workspace,
-    DERIVED_TRUTHMARK_PATHS.templatesRoot
-  );
-  const portalOutput = portalOutputFor(workspace);
-  const portalTemplate = joinWorkspacePath(
-    workspace,
-    DERIVED_TRUTHMARK_PATHS.portalTemplate
-  );
-  return {
-    version: rawConfig.version,
-    platforms: rawConfig.platforms ?? [...DEFAULT_PLATFORMS],
-    truthmark: {
-      workspace,
-      routes: {
-        index: DERIVED_TRUTHMARK_PATHS.routesIndex,
-        areas: DERIVED_TRUTHMARK_PATHS.routeAreasRoot,
-        defaultArea: DERIVED_TRUTHMARK_PATHS.defaultArea,
-        maxDelegationDepth: DERIVED_TRUTHMARK_PATHS.maxDelegationDepth
-      },
-      truth: {
-        productRoot: DERIVED_TRUTHMARK_PATHS.productTruthRoot,
-        engineeringRoot: DERIVED_TRUTHMARK_PATHS.engineeringTruthRoot
-      },
-      templates: {
-        root: DERIVED_TRUTHMARK_PATHS.templatesRoot
-      },
-      generated: {
-        portal: {
-          enabled: rawConfig.truthmark.generated.portal.enabled
-        }
-      },
-      paths: {
-        routesIndex,
-        routeAreasRoot,
-        productTruthRoot,
-        engineeringTruthRoot,
-        templatesRoot,
-        portalOutput,
-        portalTemplate
-      },
-      controlledPaths: [
-        routesIndex,
-        `${routeAreasRoot}/**/*.md`,
-        `${productTruthRoot}/**/*.md`,
-        `${engineeringTruthRoot}/**/*.md`,
-        `${templatesRoot}/*.md`
-      ]
-    },
-    frontmatter: {
-      required: rawConfig.frontmatter?.required ?? [],
-      recommended: rawConfig.frontmatter?.recommended ?? []
-    },
-    ignore: rawConfig.ignore ?? []
+var parseStringListField = (rawEntry, field) => {
+  if (!rawEntry || typeof rawEntry !== "object" || !(field in rawEntry)) {
+    return [];
+  }
+  const value = rawEntry[field];
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((entry) => typeof entry === "string");
+};
+var findTruthDocumentsYamlFenceRange = (sectionLines) => {
+  const trimmedLines = sectionLines.map((line) => line.trim());
+  const openingFenceIndex = trimmedLines.findIndex(
+    (line) => /^```(?:yaml|yml)?$/u.test(line)
+  );
+  if (openingFenceIndex === -1) {
+    return null;
+  }
+  const closingFenceIndex = trimmedLines.findIndex(
+    (line, index) => index > openingFenceIndex && line === "```"
+  );
+  return {
+    openingFenceIndex,
+    closingFenceIndex: closingFenceIndex === -1 ? null : closingFenceIndex
   };
 };
-var compatibilityDiagnostics = (rawConfig, configPath) => {
-  if (!("instruction_targets" in rawConfig)) {
-    return [];
-  }
-  return [
-    {
-      category: "config",
-      severity: "review",
-      message: "instruction_targets is accepted for compatibility but ignored; select platforms to control managed instruction-file writes.",
-      file: configPath
+var parseTruthDocumentsFromList = (sectionLines, areaName, options) => {
+  const diagnostics = [];
+  const truthDocuments = parseListSection(sectionLines);
+  const truthDocumentEntries = truthDocuments.map((documentPath) => {
+    const inferredKind = inferTruthDocumentKindFromPath(documentPath, options);
+    const inferredLane = inferTruthDocumentLaneFromPath(documentPath, options);
+    if (!inferredKind) {
+      diagnostics.push(
+        createAreaDiagnostic(
+          `Truth document ${documentPath} does not match a known kind path convention; defaulting to behavior.`,
+          areaName,
+          "review"
+        )
+      );
     }
-  ];
+    return {
+      path: documentPath,
+      kind: inferredKind ?? "engineering-behavior",
+      kindSource: inferredKind ? "inferred" : "defaulted",
+      lane: inferredLane ?? "engineering",
+      laneSource: inferredLane ? "inferred" : "defaulted",
+      realizedBy: [],
+      realizes: [],
+      dependsOn: []
+    };
+  });
+  return {
+    truthDocuments,
+    truthDocumentEntries,
+    diagnostics
+  };
 };
-var loadConfig = async (rootDir) => {
-  const absolutePath = resolveRepoPath(rootDir, CONFIG_PATH2);
-  let source;
-  try {
-    source = await fs4.readFile(absolutePath, "utf8");
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return {
-        status: "missing",
-        config: null,
-        diagnostics: [
-          toConfigDiagnostic("Missing .truthmark/config.yml.", CONFIG_PATH2)
-        ],
-        configPath: CONFIG_PATH2
-      };
-    }
-    throw error;
+var parseTruthDocumentsFromYaml = (sectionLines, areaName, options) => {
+  const yamlFenceRange = findTruthDocumentsYamlFenceRange(sectionLines);
+  if (!yamlFenceRange) {
+    return {
+      truthDocuments: [],
+      truthDocumentEntries: [],
+      diagnostics: []
+    };
   }
-  let parsedConfig;
-  try {
-    parsedConfig = parse2(source);
-  } catch (error) {
+  if (yamlFenceRange.closingFenceIndex === null) {
     return {
-      status: "invalid",
-      config: null,
+      truthDocuments: [],
+      truthDocumentEntries: [],
       diagnostics: [
-        toConfigDiagnostic(
-          `Invalid YAML: ${error instanceof Error ? error.message : String(error)}`,
-          CONFIG_PATH2
+        createAreaDiagnostic(
+          `Area ${areaName} has an unterminated fenced YAML Truth documents block.`,
+          areaName
         )
-      ],
-      configPath: CONFIG_PATH2
+      ]
     };
   }
-  const unsupportedDiagnostics = unsupportedShapeDiagnostics(
-    parsedConfig,
-    CONFIG_PATH2
-  );
-  if (unsupportedDiagnostics.length > 0) {
+  let parsedBlock;
+  try {
+    parsedBlock = parse3(
+      sectionLines.slice(
+        yamlFenceRange.openingFenceIndex + 1,
+        yamlFenceRange.closingFenceIndex
+      ).join("\n")
+    );
+  } catch (error) {
     return {
-      status: "invalid",
-      config: null,
-      diagnostics: unsupportedDiagnostics,
-      configPath: CONFIG_PATH2
+      truthDocuments: [],
+      truthDocumentEntries: [],
+      diagnostics: [
+        createAreaDiagnostic(
+          `Area ${areaName} has invalid YAML truth document metadata: ${error instanceof Error ? error.message : String(error)}.`,
+          areaName
+        )
+      ]
     };
   }
-  if (!validateTruthmarkConfig(parsedConfig)) {
+  const rawEntries = parsedBlock && typeof parsedBlock === "object" && "truth_documents" in parsedBlock ? parsedBlock.truth_documents : null;
+  if (!Array.isArray(rawEntries)) {
     return {
-      status: "invalid",
-      config: null,
-      diagnostics: (validateTruthmarkConfig.errors ?? []).map(
-        (error) => {
-          const propertyPath = error.instancePath || "/";
-          const additionalProperty = error.keyword === "additionalProperties" && error.params && "additionalProperty" in error.params ? String(error.params.additionalProperty) : null;
-          const message = additionalProperty ? `${propertyPath} additional property ${additionalProperty} is not allowed` : `${propertyPath} ${error.message ?? "is invalid"}`.trim();
-          return toConfigDiagnostic(message, CONFIG_PATH2);
-        }
-      ),
-      configPath: CONFIG_PATH2
+      truthDocuments: [],
+      truthDocumentEntries: [],
+      diagnostics: [
+        createAreaDiagnostic(
+          `Area ${areaName} must define a truth_documents array inside the fenced YAML block.`,
+          areaName
+        )
+      ]
     };
   }
-  const pathDiagnostics = validateWorkspacePaths(
-    parsedConfig,
-    CONFIG_PATH2
+  const diagnostics = [];
+  const truthDocumentEntries = [];
+  for (const rawEntry of rawEntries) {
+    const path13 = rawEntry && typeof rawEntry === "object" && "path" in rawEntry ? rawEntry.path : null;
+    const kind = rawEntry && typeof rawEntry === "object" && "kind" in rawEntry ? rawEntry.kind : null;
+    const lane = rawEntry && typeof rawEntry === "object" && "lane" in rawEntry ? rawEntry.lane : null;
+    const inferredKind = typeof path13 === "string" ? inferTruthDocumentKindFromPath(path13, options) : null;
+    const inferredLane = typeof path13 === "string" ? inferTruthDocumentLaneFromPath(path13, options) : null;
+    const normalizedKind = isTruthDocumentKind(kind) ? kind : inferredKind;
+    const normalizedLane = lane === "product" || lane === "engineering" ? lane : normalizedKind ? laneForTruthDocumentKind(normalizedKind) : inferredLane;
+    if (typeof path13 !== "string" || path13.trim().length === 0 || !normalizedKind || !normalizedLane) {
+      diagnostics.push(
+        createAreaDiagnostic(
+          `Area ${areaName} truth_documents entries must include non-empty path plus valid lane and kind fields.`,
+          areaName
+        )
+      );
+      continue;
+    }
+    truthDocumentEntries.push({
+      path: path13.trim(),
+      kind: normalizedKind,
+      kindSource: isTruthDocumentKind(kind) ? "explicit" : "inferred",
+      lane: normalizedLane,
+      laneSource: lane === "product" || lane === "engineering" ? "explicit" : "inferred",
+      realizedBy: parseStringListField(rawEntry, "realized_by"),
+      realizes: parseStringListField(rawEntry, "realizes"),
+      dependsOn: parseStringListField(rawEntry, "depends_on")
+    });
+  }
+  return {
+    truthDocuments: truthDocumentEntries.map((entry) => entry.path),
+    truthDocumentEntries,
+    diagnostics
+  };
+};
+var parseTruthDocumentsSection = (sectionLines, areaName, options) => {
+  const yamlFenceRange = findTruthDocumentsYamlFenceRange(sectionLines);
+  if (!yamlFenceRange) {
+    return parseTruthDocumentsFromList(sectionLines, areaName, options);
+  }
+  const yamlResult = parseTruthDocumentsFromYaml(
+    sectionLines,
+    areaName,
+    options
   );
-  if (pathDiagnostics.length > 0) {
-    return {
-      status: "invalid",
-      config: null,
-      diagnostics: pathDiagnostics,
-      configPath: CONFIG_PATH2
-    };
+  if (yamlResult.diagnostics.length > 0 || yamlFenceRange.closingFenceIndex === null) {
+    return yamlResult;
+  }
+  return yamlResult;
+};
+var parseAreasMarkdown = (source, options = {}) => {
+  const lines = source.split("\n");
+  const diagnostics = [];
+  const areas = [];
+  const truthDocumentReferences = [];
+  const areaFileReferences = [];
+  let areaIndex = 0;
+  let currentAreaName = null;
+  let currentSections = /* @__PURE__ */ new Map();
+  let currentSectionName = null;
+  const flushArea = () => {
+    if (!currentAreaName) {
+      return;
+    }
+    const truthDocumentResult = parseTruthDocumentsSection(
+      currentSections.get("Truth documents") ?? [],
+      currentAreaName,
+      options
+    );
+    const { truthDocuments, truthDocumentEntries } = truthDocumentResult;
+    const areaFiles = parseListSection(currentSections.get("Area files") ?? []);
+    const codeSurface = parseListSection(
+      currentSections.get("Code surface") ?? []
+    );
+    const updateTruthWhen = parseListSection(
+      currentSections.get("Update truth when") ?? []
+    );
+    const areaKey = slugify(currentAreaName);
+    const areaId = areaKey.length > 0 ? areaKey : `area-${areaIndex}`;
+    const hasTruthDocuments = truthDocuments.length > 0;
+    const hasAreaFiles = areaFiles.length > 0;
+    areaIndex += 1;
+    diagnostics.push(...truthDocumentResult.diagnostics);
+    if (hasTruthDocuments) {
+      truthDocumentReferences.push({
+        id: areaId,
+        name: currentAreaName,
+        key: areaKey,
+        truthDocuments,
+        truthDocumentEntries
+      });
+    }
+    if (hasTruthDocuments === hasAreaFiles || codeSurface.length === 0 || updateTruthWhen.length === 0) {
+      diagnostics.push(
+        createAreaDiagnostic(
+          `Area ${currentAreaName} must define exactly one of Truth documents or Area files, plus Code surface and Update truth when sections.`,
+          currentAreaName
+        )
+      );
+    } else if (hasAreaFiles) {
+      areaFileReferences.push({
+        id: areaId,
+        name: currentAreaName,
+        key: areaKey,
+        areaFiles,
+        codeSurface,
+        updateTruthWhen
+      });
+    } else {
+      areas.push({
+        id: areaId,
+        name: currentAreaName,
+        key: areaKey,
+        truthDocuments,
+        truthDocumentEntries,
+        codeSurface,
+        updateTruthWhen
+      });
+    }
+    currentAreaName = null;
+    currentSections = /* @__PURE__ */ new Map();
+    currentSectionName = null;
+  };
+  for (const line of lines) {
+    const areaHeadingMatch = line.match(/^\s{0,3}##\s+(.*)$/u);
+    if (areaHeadingMatch) {
+      const heading = areaHeadingMatch[1]?.trim() ?? null;
+      flushArea();
+      currentAreaName = heading === "Source References" ? null : heading;
+      continue;
+    }
+    if (!currentAreaName) {
+      continue;
+    }
+    if (/^(Truth documents|Area files|Code surface|Update truth when):$/u.test(
+      line.trim()
+    )) {
+      currentSectionName = line.trim().slice(0, -1);
+      currentSections.set(currentSectionName, []);
+      continue;
+    }
+    if (currentSectionName) {
+      currentSections.get(currentSectionName)?.push(line);
+    }
   }
+  flushArea();
   return {
-    status: "loaded",
-    config: normalizeConfig(parsedConfig),
-    diagnostics: compatibilityDiagnostics(
-      parsedConfig,
-      CONFIG_PATH2
-    ),
-    configPath: CONFIG_PATH2
+    areas,
+    truthDocumentReferences,
+    areaFileReferences,
+    diagnostics
   };
 };
 
-// src/truth/evidence.ts
-var renderClaimEvidenceCheckedSection = (items) => {
+// src/templates/init-files.ts
+import path4 from "path";
+import { stringify as stringify2 } from "yaml";
+var asRelativePath = (value) => {
+  return value.split(path4.sep).join("/");
+};
+var currentDate = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+var resolveRelativePath = (fromPath, toPath) => {
+  return asRelativePath(path4.relative(path4.dirname(fromPath), toPath));
+};
+var truthRoot = resolveEngineeringTruthRoot;
+var renderLaneRootReadmeSummary = (lane) => {
+  if (lane === "product") {
+    return [
+      "Product truth owns capability promises, boundaries, decisions, and acceptance criteria.",
+      "Product lane docs state what must be true, why it matters, and what success means."
+    ].join(" ");
+  }
   return [
-    "Evidence checked:",
-    ...items.map((item) => {
-      return [
-        `- Claim: ${item.claim}`,
-        `  Evidence: ${item.evidence.join(" / ")}`,
-        `  Result: ${item.result}`
-      ].join("\n");
-    })
-  ].join("\n");
+    "Engineering truth owns current realization, contracts, architecture, workflows, operations, and tests.",
+    "Engineering lane docs describe how the repository currently implements and operates the behavior."
+  ].join(" ");
 };
-var renderAuditEvidenceCheckedSection = (items) => {
+var renderLaneRootLeafDocGuidance = (lane) => {
+  if (lane === "product") {
+    return "README.md files are indexes, not Truth Sync targets. Keep product truth in bounded capability docs.";
+  }
+  return "README.md files are indexes, not Truth Sync targets. Keep engineering truth in bounded behavior, contract, architecture, workflow, operations, and test docs.";
+};
+var titleCase = (value) => {
+  return value.split(/[-_\s]+/u).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1)).join(" ");
+};
+var renderHierarchicalAreasIndexTemplate = (config) => {
+  const defaultArea = config.truthmark.routes.defaultArea;
+  const childPath = `${config.truthmark.paths.routeAreasRoot}/${defaultArea}.md`;
+  const title = titleCase(defaultArea);
+  const sourceOfTruth = resolveRelativePath(
+    config.truthmark.paths.routesIndex,
+    ".truthmark/config.yml"
+  );
   return [
-    "Evidence checked:",
-    ...items.map((item) => {
-      return [
-        `- Finding: ${item.finding}`,
-        `  Evidence: ${item.evidence.join(" / ")}`,
-        `  Suggested fix: ${item.suggestedFix}`,
-        `  Confidence: ${item.confidence}`
-      ].join("\n");
-    })
+    "---",
+    "status: active",
+    "doc_type: route-index",
+    `last_reviewed: ${currentDate()}`,
+    "---",
+    "",
+    "# Truthmark Areas",
+    "",
+    `## ${title}`,
+    "",
+    "Area files:",
+    `- ${childPath}`,
+    "",
+    "Code surface:",
+    "- src/**",
+    "",
+    "Update truth when:",
+    "- behavior changes affect the routed truth documents",
+    "- API contracts or current feature behavior changes",
+    "",
+    "## Source References",
+    "",
+    `- ${sourceOfTruth}`,
+    ""
   ].join("\n");
 };
-
-// src/agents/shared.ts
-var renderBulletLine = (line) => {
-  const normalized = line.trim().replace(/^-\s*/u, "");
-  return `- ${normalized}`;
-};
-var renderBulletBlock = (lines, indent = "  ") => {
-  return lines.split(/\n/u).map((line) => line.trim()).filter((line) => line.length > 0).map((line) => `${indent}${renderBulletLine(line)}`).join("\n");
+var renderChildAreaTemplate = (config) => {
+  const defaultArea = config.truthmark.routes.defaultArea;
+  const title = titleCase(defaultArea);
+  const truthDocsRoot = truthRoot(config);
+  const bootstrapTruthDoc = `${truthDocsRoot}/${defaultArea}/bootstrap-routing.md`;
+  const templatePath = `${config.truthmark.paths.routeAreasRoot}/${defaultArea}.md`;
+  const sourceOfTruth = resolveRelativePath(
+    templatePath,
+    ".truthmark/config.yml"
+  );
+  return [
+    "---",
+    "status: active",
+    "doc_type: area-route",
+    `last_reviewed: ${currentDate()}`,
+    "---",
+    "",
+    `# ${title} Areas`,
+    "",
+    `## ${title}`,
+    "",
+    "Truth documents:",
+    "```yaml",
+    "truth_documents:",
+    `  - path: ${bootstrapTruthDoc}`,
+    "    kind: engineering-workflow",
+    "    lane: engineering",
+    "```",
+    "",
+    "This is a provisional bootstrap route. It exists only to make fresh repositories routeable until real product, service, domain, or ownership areas are created.",
+    "",
+    "Code surface:",
+    "- src/**",
+    "",
+    "Update truth when:",
+    "- this provisional bootstrap route is the only match for a real code surface",
+    "- route ownership is still broad, mixed, or ambiguous",
+    "- Run Truth Structure before normal Truth Sync so the touched code gets a bounded owner",
+    "",
+    "## Source References",
+    "",
+    `- ${sourceOfTruth}`,
+    ""
+  ].join("\n");
 };
-var renderLaneClassificationRuleBlock = (config = defaultAgentConfig(), indent = "  ") => {
-  const [, ...rules] = renderLaneClassificationInstructions(config).split(/\n/u);
-  return renderBulletBlock(rules.join("\n"), indent);
+var renderBootstrapRoutingDocTemplate = (config) => {
+  const defaultArea = config.truthmark.routes.defaultArea;
+  const title = titleCase(defaultArea);
+  const templatePath = `${truthRoot(config)}/${defaultArea}/bootstrap-routing.md`;
+  const routePath = `${config.truthmark.paths.routeAreasRoot}/${defaultArea}.md`;
+  const routeSource = resolveRelativePath(templatePath, routePath);
+  const configSource = resolveRelativePath(
+    templatePath,
+    ".truthmark/config.yml"
+  );
+  const today = currentDate();
+  return [
+    "---",
+    "status: active",
+    "truth_kind: engineering-workflow",
+    `last_reviewed: ${today}`,
+    "---",
+    "",
+    `# ${title} Bootstrap Routing`,
+    "",
+    "## Purpose",
+    "",
+    `This doc records the provisional broad route for ${defaultArea}.`,
+    "This doc is a bootstrap handoff, not a behavior truth dumping ground.",
+    "It is not a substitute for bounded product and engineering truth docs.",
+    "",
+    "## Scope",
+    "",
+    "This doc owns only the initial routing workflow for a fresh Truthmark repository whose default route still maps a broad code surface such as `src/**`.",
+    "It does not own implementation behavior under that code surface.",
+    "",
+    "## Current Implementation Behavior",
+    "",
+    "The scaffold creates this provisional bootstrap handoff only when a default broad route needs a canonical owner. Agents use it as a signal to run Truth Structure and create bounded routes before normal Truth Sync, not as a place to accumulate implementation claims.",
+    "",
+    "## Product Truth Links",
+    "",
+    "- None. This is an engineering bootstrap handoff for routing setup, not a product promise.",
+    "",
+    "## Triggers",
+    "",
+    "- A real code change maps only to this provisional broad route.",
+    "- Truth Sync cannot identify a specific behavior-owned route and bounded truth owner.",
+    "- A maintainer or agent is onboarding the first real product, service, domain, package, or ownership area.",
+    "",
+    "## Inputs",
+    "",
+    "- Current route files under the configured Truthmark route root.",
+    "- The touched code, tests, configuration, and existing docs needed to infer the smallest real owner.",
+    "- Repository instruction files that exist in the checkout.",
+    "",
+    "## Execution Model",
+    "",
+    "Run Truth Structure before normal Truth Sync when real code changes touch only this broad route. Truth Structure should create or repair bounded areas first; Truth Sync should then update the bounded owner docs.",
+    "",
+    "## Steps",
+    "",
+    "1. Treat this route as provisional and insufficient for normal behavior maintenance.",
+    "2. Inspect the touched code/test surface and infer the narrowest durable owner.",
+    "3. Create or repair route entries and truth docs for that owner.",
+    "4. Leave this bootstrap doc small; do not append behavior details here.",
+    "5. Resume Truth Sync only after the touched code resolves to a bounded owner.",
+    "",
+    "## State, Retry, And Failure Behavior",
+    "",
+    "If ownership cannot be inferred safely, stop and report manual-review files instead of widening this route or adding generic behavior prose.",
+    "",
+    "## Outputs",
+    "",
+    "- Bounded route areas and lane-appropriate truth docs for the touched surface.",
+    "- A compact manual handoff report when ownership remains ambiguous.",
+    "",
+    "## Engineering Decisions",
+    "",
+    `- Decision (${today}): Default broad routing is provisional bootstrap state. Agents should create bounded areas before normal Truth Sync rather than extending a catch-all overview doc.`,
+    "",
+    "## Rationale",
+    "",
+    "Scoped ownership keeps agent context close to affected files and prevents broad default docs from absorbing unrelated behavior. This preserves agent-native truth maintenance without adding a token-heavy discovery layer.",
+    "",
+    "## Non-Goals",
+    "",
+    "- This doc is not a repository behavior overview.",
+    "- This doc is not a product capability or engineering behavior owner.",
+    "- This doc is not a permanent home for claims about files under `src/**`.",
+    "",
+    "## Maintenance Notes",
+    "",
+    "Keep this doc short. When a repository has real bounded routes, prefer updating those routes and their truth docs instead of expanding this bootstrap handoff.",
+    "",
+    "## Source References",
+    "",
+    `- ${routeSource}`,
+    `- ${configSource}`,
+    ""
+  ].join("\n");
 };
-var renderReadOnlyLaneClassificationRuleBlock = (config = defaultAgentConfig(), indent = "  ") => {
-  const productTruthRoot = resolveProductTruthRoot(config);
-  const engineeringTruthRoot = resolveEngineeringTruthRoot(config);
-  return renderBulletBlock(
-    [
-      "classify the request or changed surface as product-lane, engineering-lane, both-lane, or ambiguous for reporting only",
-      `product-lane ownership belongs under ${productTruthRoot} and describes product promises, boundaries, rationale, decisions, and success criteria`,
-      `engineering-lane ownership belongs under ${engineeringTruthRoot} and describes source-backed current realization, contracts, architecture, workflows, operations, or tests`,
-      "both-lane ownership uses separate product and engineering docs cross-linked in route YAML with realized_by and realizes, not in doc frontmatter",
-      "ambiguous lane ownership should be reported for manual handoff or routed to Truth Structure",
-      LANE_INVARIANT
-    ].join("\n"),
-    indent
+var renderTruthRootReadmeTemplate = (config = createDefaultConfig(), lane = "engineering") => {
+  const templatePath = `${lane === "product" ? resolveProductTruthRoot(config) : resolveEngineeringTruthRoot(config)}/README.md`;
+  const sourceOfTruth = resolveRelativePath(
+    templatePath,
+    config.truthmark.paths.routesIndex
   );
-};
-var DECISION_TRUTH_INSTRUCTIONS = [
-  "Decision truth lives in the canonical doc it governs; date active decisions inline when added or changed.",
-  "Do not create separate active-decision ADR/planning logs; replace the active decision and let Git history carry the audit trail.",
-  "Product decisions belong in product truth; engineering, architecture, contract, workflow, and operational decisions belong in engineering truth."
-].join("\n");
-var LANE_INVARIANT = "Do not make product docs a summary of engineering docs. Do not make engineering docs a detailed version of product docs. Product truth says what must be true and why. Engineering truth says how the repository currently realizes it.";
-var renderLaneClassificationInstructions = (config = defaultAgentConfig()) => {
-  const productTruthRoot = resolveProductTruthRoot(config);
-  const engineeringTruthRoot = resolveEngineeringTruthRoot(config);
   return [
-    "Lane review questions:",
-    "- before writing canonical truth docs, classify the request or change as product-lane, engineering-lane, both-lane, or ambiguous",
-    `- product-lane writes belong under ${productTruthRoot} and state product promises, boundaries, rationale, decisions, and success criteria`,
-    `- engineering-lane writes belong under ${engineeringTruthRoot} and state source-backed current realization, contracts, architecture, workflows, operations, or tests`,
-    "- both-lane work must write separate product and engineering docs and cross-link them in route YAML with realized_by and realizes, not in doc frontmatter",
-    "- ambiguous lane ownership must stop or invoke Truth Structure instead of writing a mixed document",
-    `- ${LANE_INVARIANT}`
+    "---",
+    "status: active",
+    "doc_type: index",
+    `last_reviewed: ${currentDate()}`,
+    "---",
+    "",
+    "# Truth Docs",
+    "",
+    "This directory is an index for current truth docs organized by the configured Truthmark hierarchy.",
+    "",
+    renderLaneRootReadmeSummary(lane),
+    "",
+    renderLaneRootLeafDocGuidance(lane),
+    "",
+    "## Source References",
+    "",
+    `- ${sourceOfTruth}`,
+    ""
   ].join("\n");
 };
-var EVIDENCE_AUTHORITY_INSTRUCTIONS = [
-  "Repository instruction files and explicitly configured policy docs remain instruction authority when present; do not assume a repository uses any particular policy path.",
-  "Implementation code and canonical truth docs are inspected evidence for current behavior; they do not silently override workflow write boundaries."
-].join("\n");
-var REPOSITORY_INTELLIGENCE_INSTRUCTIONS = [
-  "Repository intelligence artifacts are optional derived context: RepoIndex, RouteMap, ImpactSet, and WorkflowState/action context may guide routing, write boundaries, and verification planning when available.",
-  "They do not override checkout evidence, canonical truth docs, route files, or workflow write boundaries.",
-  "If unavailable, inspect any present Truthmark config, route files, source files, truth docs, and tests directly, then report that repository-intelligence artifacts were not generated."
-].join("\n");
-var FEATURE_DOC_TEMPLATE_INSTRUCTIONS = [
-  "When creating or updating a truth doc, inspect the routed truth kind and use the matching template under the configured Truthmark templates root.",
-  "Supported kinds: product-capability, engineering-behavior, engineering-contract, engineering-architecture, engineering-workflow, engineering-operations, and engineering-test-behavior.",
-  "Treat the HTML comments under each template section as normative authoring guidance for that section.",
-  "Align existing docs to that template and write or repair section content so it satisfies the comment guidance while preserving accurate authored content.",
-  "If the template is missing, use lane-specific sections: product truth says what must be true and why; engineering truth says how the repository currently realizes it.",
-  "Teams may edit template files under the configured Truthmark templates root to define their local truth-doc standards."
-].join("\n");
-var TRUTH_DOC_AUTHORING_STYLE_INSTRUCTIONS = [
-  "Truth-doc prose style:",
-  "- Use professional, plain technical prose. Prefer specific current-state claims over promotional, symbolic, or generic significance language.",
-  "- Avoid common AI-writing tells: pivotal, crucial, underscores, serves as, stands as, showcases, landscape, vague expert attributions, and generic upbeat conclusions.",
-  "- Keep claims evidence-backed and diff-friendly: one durable claim per bullet or line; paragraphs should be no longer than one or two short sentences.",
-  "- Do not add personality, rhetorical flourish, first-person commentary, or marketing tone.",
-  "- Rewrite dense or formulaic prose only when it improves readability without removing scope, evidence, decisions, or source references."
-].join("\n");
-var renderTruthDocOwnershipGateSection = (subject, outcome) => {
+var renderTruthDomainReadmeTemplate = (config) => {
+  const defaultArea = config.truthmark.routes.defaultArea;
+  const title = titleCase(defaultArea);
+  const templatePath = `${truthRoot(config)}/${defaultArea}/README.md`;
+  const sourceOfTruth = resolveRelativePath(
+    templatePath,
+    `${config.truthmark.paths.routeAreasRoot}/${defaultArea}.md`
+  );
   return [
-    "Truth-doc ownership review:",
-    `- before editing or relying on ${subject}, verify each target/source truth doc is a bounded owner for the behavior`,
-    "- if a target/source doc mixes independent owners, spans unrelated behaviors, acts as an index, or needs cross-owner edits, do not patch or in-place repair it",
-    `- ${outcome}`,
-    "- report Ownership reviewed, Structure required, Truth docs split, Truth docs restructured, or Manual handoff reason as applicable"
+    "---",
+    "status: active",
+    "doc_type: index",
+    `last_reviewed: ${currentDate()}`,
+    "---",
+    "",
+    `# ${title} Truth Docs`,
+    "",
+    `This directory indexes bounded ${title.toLowerCase()} truth docs.`,
+    "",
+    "README.md files are indexes, not Truth Sync targets. Keep bounded truth in leaf docs in this directory.",
+    "",
+    "Current leaf docs:",
+    "",
+    "- [Bootstrap routing](bootstrap-routing.md)",
+    "",
+    "## Source References",
+    "",
+    `- ${sourceOfTruth}`,
+    ""
   ].join("\n");
 };
-var TRUTH_DOC_DECISION_RATIONALE_PRESERVATION_INSTRUCTIONS = [
-  "Decision/Rationale preservation review:",
-  "- before any truth-doc split, restructure, or shape repair, inventory existing Product Decisions, Engineering Decisions, and Rationale sections in every source or touched truth doc",
-  "- preserve each current decision and rationale in the correct product or engineering lane owner; when splitting, move it to the new owner doc rather than deleting it or leaving it in an index",
-  "- remove or narrow a decision or rationale only when checkout evidence shows it is stale or unsupported, and report the exact claim, evidence, and result",
-  "- if ownership of a decision or rationale is unclear, stop with manual-review files instead of deleting it or guessing",
-  "- after the edit, verify every touched truth doc keeps lane-appropriate decision/rationale sections and every pre-existing entry is preserved, moved, narrowed, removed with evidence, or blocked"
-].join("\n");
-var renderTruthDocRestructureGateSection = (scope) => {
+var renderTemplateSection = (section) => {
   return [
-    "Truth-doc shape repair review:",
-    `- ${scope}`,
-    "- repair shape in place only after the ownership review confirms the doc is the right bounded owner",
-    "- use Truth Structure for ownership splits; do not treat broad or mixed-owner docs as in-place repair work",
-    "- repair shape when a narrow edit would make truth worse: missing template sections, stale evidence conflicts, cross-section updates within one owner, or wrong frontmatter/source/headings",
-    "- preserve supported claims; remove, narrow, or record unsupported or stale claims for manual handoff",
-    "- report docs restructured and why a narrow edit was not sufficient"
-  ].join("\n");
+    section.heading,
+    "",
+    "<!--",
+    ...section.guidance,
+    "-->",
+    "",
+    `{{${section.placeholder}}}`,
+    ""
+  ];
 };
-var ARCHITECTURE_DOC_BOUNDARY_INSTRUCTIONS = [
-  "Maintain architecture docs only for structure-level changes: system structure, module boundaries, runtime topology, persistence boundaries, cross-cutting contracts, or generated-surface ownership.",
-  "Keep ordinary behavior, endpoints, UI copy, validation rules, and bug fixes in behavior or contract docs unless they change those boundaries."
-].join("\n");
-var renderRouteFirstEvidenceGateSection = (subject, noImpactedDocOutcome) => {
-  return [
-    "Evidence checklist:",
-    `- route-first: map ${subject} to bounded route owners and primary canonical docs`,
-    "- review new or changed behavior-bearing claims only in touched docs, route ownership, lane-specific decisions, and rationale",
-    "- support claims with primary checkout evidence: implementation, config, routing, generated templates, schemas, or contract definitions",
-    "- tests/examples/canonical docs corroborate; they are not sole proof when implementation conflicts",
-    "- remove, narrow, or record unsupported claims for manual handoff",
-    `- ${noImpactedDocOutcome}`
-  ].join("\n");
+var titleToPlaceholder = (title) => {
+  return title.replace(/^#+\s+/u, "").toLowerCase().replaceAll(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 };
-var renderTopologyEvidenceGateSection = () => {
-  return [
-    "Evidence checklist:",
-    "- apply the evidence checklist before finishing when Truth Structure writes routed docs, ownership claims, lane-specific decisions, or rationale",
-    "- support ownership/behavior claims with topology or primary checkout evidence from layout, implementation boundaries, docs, config, route files, tests, templates, schemas, or contracts",
-    "- tests/examples/canonical docs corroborate; remove, narrow, or record unsupported claims for manual handoff"
-  ].join("\n");
+var findTemplateSectionHeadings = (template) => {
+  const matches = [];
+  let fencedCodeMarker = null;
+  let fencedCodeLength = 0;
+  for (const lineMatch of template.matchAll(/^.*(?:\r?\n|$)/gm)) {
+    const rawLine = lineMatch[0];
+    if (rawLine.length === 0) {
+      continue;
+    }
+    const line = rawLine.replace(/\r?\n$/u, "");
+    const fenceMatch = /^(?: {0,3})(`{3,}|~{3,})/u.exec(line);
+    if (fenceMatch) {
+      const marker = fenceMatch[1]?.[0];
+      const length = fenceMatch[1]?.length ?? 0;
+      if (fencedCodeMarker === null) {
+        fencedCodeMarker = marker;
+        fencedCodeLength = length;
+      } else if (marker === fencedCodeMarker && length >= fencedCodeLength) {
+        fencedCodeMarker = null;
+        fencedCodeLength = 0;
+      }
+      continue;
+    }
+    if (fencedCodeMarker === null && /^## .+$/u.test(line)) {
+      matches.push({ heading: line.trim(), index: lineMatch.index });
+    }
+  }
+  return matches;
 };
-var renderAuditEvidenceGateSection = () => {
-  return [
-    "Evidence checklist:",
-    "- support each finding and suggested fix with evidence from config, route files, canonical docs, implementation, templates, or tests",
-    "- canonical docs are context, not sole proof when implementation conflicts",
-    "- remove unsupported findings or mark open questions; validate changed claims if you edit docs"
-  ].join("\n");
+var parseTemplateSections = (template) => {
+  const matches = findTemplateSectionHeadings(template);
+  if (matches.length === 0) {
+    return { preamble: template.trimEnd(), sections: [] };
+  }
+  const sections = matches.map((match, index) => {
+    const start = match.index;
+    const next = matches[index + 1];
+    const end = next?.index ?? template.length;
+    return {
+      heading: match.heading,
+      block: template.slice(start, end).trimEnd()
+    };
+  });
+  return {
+    preamble: template.slice(0, matches[0]?.index ?? 0).trimEnd(),
+    sections
+  };
 };
-var renderCodexSubagentModeSection = (agents, parentRule, writeAgents = []) => {
-  const writeAgentLines = writeAgents.length > 0 ? [
-    `- dispatch write-capable project agents only with explicit write leases: ${writeAgents.join(", ")}`,
-    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
-    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
-    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
-  ] : [];
-  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
-  const readOnlyWorkerLabel = writeAgents.length > 0 ? "read-only workers" : "workers";
-  return [
-    "Codex subagent mode:",
-    "- use automatically when this workflow runs in Codex and the parent agent chooses bounded subagent fan-out",
-    `- dispatch read-only project agents ${readOnlyScope}: ${agents.join(", ")}`,
-    `- ${readOnlyWorkerLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
-    `- parent supplies bounded evidence shards; ${readOnlyWorkerLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
-    ...writeAgentLines,
-    `- ${parentRule}`
-  ].join("\n");
+var LEGACY_MANAGED_TEMPLATE_HEADINGS = /* @__PURE__ */ new Map([
+  ["## Current Behavior", "## Current Implementation Behavior"],
+  ["## Source Evidence", "## Source References"]
+]);
+var resolveManagedTemplateHeading = (heading) => {
+  return LEGACY_MANAGED_TEMPLATE_HEADINGS.get(heading) ?? heading;
 };
-var renderOpenCodeSubagentModeSection = (agents, parentRule, writeAgents = []) => {
-  const mentions = agents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
-  const writeMentions = writeAgents.map(
-    (agent) => `@${agent.replace(/_/gu, "-")}`
+var stripManagedFrontmatterFields = (preamble) => {
+  if (!preamble.startsWith("---\n")) {
+    return preamble;
+  }
+  const lines = preamble.split("\n");
+  const closingIndex = lines.findIndex(
+    (line, index) => index > 0 && line.trim() === "---"
   );
-  const writeAgentLines = writeMentions.length > 0 ? [
-    `- dispatch write-capable project subagents only with explicit write leases: ${writeMentions.join(", ")}`,
-    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
-    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
-    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
-  ] : [];
-  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
-  const readOnlyWorkerLabel = writeAgents.length > 0 ? "read-only workers" : "workers";
+  if (closingIndex < 0) {
+    return preamble;
+  }
+  const fieldsToRemove = /* @__PURE__ */ new Set(["source_of_truth", "doc_type", "truth_lane"]);
+  const keptFrontmatterLines = [];
+  let skippingManagedField = false;
+  for (const line of lines.slice(1, closingIndex)) {
+    const keyMatch = /^([A-Za-z0-9_-]+):(\s|$)/u.exec(line);
+    if (keyMatch) {
+      skippingManagedField = fieldsToRemove.has(keyMatch[1] ?? "");
+    }
+    if (!skippingManagedField) {
+      keptFrontmatterLines.push(line);
+    }
+  }
   return [
-    "OpenCode subagent mode:",
-    "- use automatically when this workflow runs in OpenCode and the parent agent chooses bounded subagent fan-out",
-    `- dispatch read-only project subagents ${readOnlyScope}: ${mentions.join(", ")}`,
-    `- ${readOnlyWorkerLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
-    `- parent supplies bounded evidence shards; ${readOnlyWorkerLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
-    ...writeAgentLines,
-    `- ${parentRule}`
-  ].join("\n");
+    "---",
+    ...keptFrontmatterLines,
+    "---",
+    ...lines.slice(closingIndex + 1)
+  ].join("\n").trimEnd();
 };
-var renderClaudeSubagentModeSection = (agents, parentRule, writeAgents = []) => {
-  const mentions = agents.map(
-    (agent) => `${agent.replace(/_/gu, "-")} subagent`
-  );
-  const writeMentions = writeAgents.map(
-    (agent) => `${agent.replace(/_/gu, "-")} subagent`
+var mergeTruthDocTemplate = (existingTemplate, defaultTemplate) => {
+  if (existingTemplate.trim().length === 0) {
+    return defaultTemplate;
+  }
+  const defaultParsed = parseTemplateSections(defaultTemplate);
+  const existingParsed = parseTemplateSections(existingTemplate);
+  const defaultHeadings = new Set(
+    defaultParsed.sections.map((section) => section.heading)
   );
-  const writeAgentLines = writeMentions.length > 0 ? [
-    `- dispatch write-capable project subagents only with explicit write leases: ${writeMentions.join(", ")}`,
-    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
-    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
-    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
-  ] : [];
-  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
-  const readOnlySubagentLabel = writeAgents.length > 0 ? "read-only subagents" : "subagents";
+  const customBeforeDefault = /* @__PURE__ */ new Map();
+  const trailingCustomSections = [];
+  existingParsed.sections.forEach((section, index) => {
+    if (defaultHeadings.has(resolveManagedTemplateHeading(section.heading))) {
+      return;
+    }
+    const nextDefaultSection = existingParsed.sections.slice(index + 1).find(
+      (candidate) => defaultHeadings.has(resolveManagedTemplateHeading(candidate.heading))
+    );
+    if (nextDefaultSection) {
+      const nextDefaultHeading = resolveManagedTemplateHeading(
+        nextDefaultSection.heading
+      );
+      const bucket = customBeforeDefault.get(nextDefaultHeading) ?? [];
+      bucket.push(section);
+      customBeforeDefault.set(nextDefaultHeading, bucket);
+      return;
+    }
+    trailingCustomSections.push(section);
+  });
+  const mergedSections = defaultParsed.sections.flatMap((section) => [
+    ...customBeforeDefault.get(section.heading) ?? [],
+    section
+  ]);
   return [
-    "Claude Code subagent mode:",
-    "- use automatically when this workflow runs in Claude Code and the parent agent chooses bounded subagent fan-out",
-    `- dispatch read-only project subagents ${readOnlyScope}: ${mentions.join(", ")}`,
-    `- ${readOnlySubagentLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
-    `- parent supplies bounded evidence shards; ${readOnlySubagentLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
-    ...writeAgentLines,
-    `- ${parentRule}`
-  ].join("\n");
+    stripManagedFrontmatterFields(existingParsed.preamble),
+    ...mergedSections.map((section) => section.block),
+    ...trailingCustomSections.map((section) => section.block),
+    ""
+  ].filter((block) => block.length > 0).join("\n\n");
 };
-var renderCopilotCustomAgentModeSection = (agents, parentRule, writeAgents = []) => {
-  const mentions = agents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
-  const writeMentions = writeAgents.map(
-    (agent) => `@${agent.replace(/_/gu, "-")}`
-  );
-  const writeAgentLines = writeMentions.length > 0 ? [
-    `- dispatch write-capable project custom agents only with explicit write leases: ${writeMentions.join(", ")}`,
-    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
-    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
-    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
-  ] : [];
-  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
-  const readOnlyCustomAgentLabel = writeAgents.length > 0 ? "read-only custom agents" : "custom agents";
+var renderBehaviorDocTemplateFile = () => {
   return [
-    "Copilot custom-agent mode:",
-    "- use automatically when this workflow runs in Copilot and the parent agent chooses bounded custom-agent fan-out",
-    `- dispatch read-only project custom agents ${readOnlyScope}: ${mentions.join(", ")}`,
-    `- ${readOnlyCustomAgentLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
-    `- parent supplies bounded evidence shards; ${readOnlyCustomAgentLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
-    ...writeAgentLines,
-    `- ${parentRule}`
+    "---",
+    "status: active",
+    "truth_kind: engineering-behavior",
+    `last_reviewed: ${currentDate()}`,
+    "---",
+    "",
+    "# {{title}}",
+    "",
+    "## Purpose",
+    "",
+    "<!--",
+    "State the user/system outcome this behavior protects and why it exists.",
+    "Include the problem boundary and durable value; exclude roadmap, implementation plan, and historical narrative.",
+    "List the code, config, docs, or tests that support the claim in Source References rather than prose-only assertion.",
+    "-->",
+    "",
+    "{{purpose}}",
+    "",
+    "## Scope",
+    "",
+    "<!--",
+    "Define the one coherent behavior surface this document owns.",
+    "Include in-scope actors, entrypoints, state/data owned by this doc, and explicit handoffs to neighboring truth docs.",
+    "Split into another leaf doc when content introduces a distinct outcome, state machine, rule family, external contract, or route owner.",
+    "Keep README.md files as indexes only.",
+    "-->",
+    "",
+    "{{scope}}",
+    "",
+    "This doc was created from the editable engineering-behavior template at {{template_path}}.",
+    "",
+    "## Current Implementation Behavior",
+    "",
+    "<!--",
+    "Describe only current implemented behavior in present tense.",
+    "Cover observable behavior, important defaults, and user/system-visible effects; exclude desired future behavior and speculative design.",
+    "Every non-obvious claim should be checkable from Source References.",
+    "-->",
+    "",
+    "{{current_implementation_behavior}}",
+    "",
+    "## Core Rules",
+    "",
+    "<!--",
+    "Capture stable business rules, invariants, precedence rules, validation rules, and must-never constraints.",
+    "Separate rules from incidental implementation details; cite current implementation or tests for rule enforcement.",
+    "-->",
+    "",
+    "{{core_rules}}",
+    "",
+    "## Behavior Scenarios",
+    "",
+    "<!--",
+    "Use compact scenario blocks only where they clarify normal, fallback, or compatibility-critical behavior.",
+    "Write scenarios as current truth, not desired requirements: `#### Scenario: <implemented case>` followed by `- **GIVEN** ...`, `- **WHEN** ...`, `- **THEN** ...`, and optional `- **AND** ...` bullets.",
+    "Keep each bullet evidence-backed and observable; do not force a scenario for every rule.",
+    "-->",
+    "",
+    "{{behavior_scenarios}}",
+    "",
+    "## Flows And States",
+    "",
+    "<!--",
+    "Document state transitions, lifecycle stages, retries, fallbacks, route switches, and important error paths.",
+    "State 'None beyond current behavior.' when this behavior has no distinct flow or state model.",
+    "-->",
+    "",
+    "{{flows_and_states}}",
+    "",
+    "## Contracts",
+    "",
+    "<!--",
+    "Capture user-visible or integration contracts: CLI/API shape, inputs, outputs, diagnostics, files, events, permissions, or links to canonical contract docs.",
+    "Avoid duplicating a separate canonical contract doc; link to it when contract ownership lives elsewhere.",
+    "-->",
+    "",
+    "{{contracts}}",
+    "",
+    "## Product Truth Links",
+    "",
+    "<!--",
+    "List product truth docs this engineering doc realizes; author canonical realizes links in route YAML, not doc frontmatter.",
+    "Use 'None.' when this is purely internal engineering behavior.",
+    "-->",
+    "",
+    "{{product_truth_links}}",
+    "",
+    "## Engineering Decisions",
+    "",
+    "<!--",
+    "Keep active decisions only, dated inline when added or changed.",
+    "Explain decisions that shape behavior, boundaries, rejected alternatives, or migration constraints; replace stale decisions instead of appending historical logs.",
+    "-->",
+    "",
+    "{{engineering_decisions}}",
+    "",
+    "## Rationale",
+    "",
+    "<!--",
+    "Explain why the current behavior and active decisions are this way, including tradeoffs and constraints.",
+    "Tie rationale to evidence-backed behavior; do not use this as a changelog.",
+    "-->",
+    "",
+    "{{rationale}}",
+    "",
+    "## Non-Goals",
+    "",
+    "<!--",
+    "Name adjacent behavior this doc intentionally does not own, especially tempting future expansions or neighboring route owners.",
+    "Use this section to prevent scope creep and duplicate truth ownership.",
+    "-->",
+    "",
+    "{{non_goals}}",
+    "",
+    "## Maintenance Notes",
+    "",
+    "<!--",
+    "List related tests, routing cautions, migration notes, evidence drift risks, and review triggers for future maintainers or agents.",
+    "Keep this operational and current-state focused, not historical.",
+    "-->",
+    "",
+    "{{maintenance_notes}}",
+    "",
+    "## Source References",
+    "",
+    "<!--",
+    "List source files, tests, configs, generated templates, route files, or product instructions that support current claims.",
+    "-->",
+    "",
+    "{{source_references}}",
+    ""
   ].join("\n");
 };
-var defaultAgentConfig = () => {
-  return createDefaultConfig();
-};
-var renderHierarchySummary = (config) => {
-  const productRoot = resolveProductTruthRoot(config);
-  const engineeringRoot = resolveEngineeringTruthRoot(config);
+var sectionSpec = (heading, guidance, placeholder = titleToPlaceholder(heading)) => ({ heading, guidance, placeholder });
+var PURPOSE_SECTION = sectionSpec("## Purpose", [
+  "State the software-engineering outcome this document protects and why the documented surface exists.",
+  "Include durable value, impacted users/systems, and the problem boundary; exclude roadmap, implementation plans, and historical narrative.",
+  "Keep claims traceable to Source References rather than prose-only assertion."
+]);
+var SCOPE_SECTION = sectionSpec("## Scope", [
+  "Define the one coherent surface this document owns, including actors, entrypoints, owned state/data, and handoffs to neighboring truth docs.",
+  "Call out important out-of-scope boundaries here or in Non-Goals; split the doc when it mixes distinct outcomes, lifecycles, contracts, or owners."
+]);
+var PRODUCT_DECISIONS_SECTION = sectionSpec(
+  "## Product Decisions",
+  [
+    "Keep active decisions only, dated inline when added or changed.",
+    "Capture decisions that shape behavior, interfaces, boundaries, compatibility, risk acceptance, or migration constraints.",
+    "Replace stale decisions instead of appending historical logs."
+  ],
+  "decision"
+);
+var ENGINEERING_DECISIONS_SECTION = sectionSpec(
+  "## Engineering Decisions",
+  [
+    "Keep active engineering, architecture, contract, workflow, or operational decisions only, dated inline when added or changed.",
+    "Do not restate product promises, product rationale, or business decisions here; link product truth instead.",
+    "Replace stale decisions instead of appending historical logs."
+  ],
+  "engineering_decisions"
+);
+var RATIONALE_SECTION = sectionSpec("## Rationale", [
+  "Explain why the current behavior, structure, or contract is this way, including tradeoffs and constraints.",
+  "Tie rationale to evidence-backed facts and active decisions; do not use this as a changelog."
+]);
+var NON_GOALS_SECTION = sectionSpec("## Non-Goals", [
+  "Name adjacent behavior, responsibilities, interfaces, or future expansions this doc intentionally does not own.",
+  "Use this section to prevent scope creep and duplicate truth ownership."
+]);
+var MAINTENANCE_NOTES_SECTION = sectionSpec("## Maintenance Notes", [
+  "List related tests, routing cautions, migration notes, compatibility risks, evidence drift risks, and review triggers for future maintainers or agents.",
+  "Keep this operational and current-state focused, not historical."
+]);
+var SOURCE_REFERENCES_SECTION = sectionSpec(
+  "## Source References",
+  [
+    "List source files, tests, configs, generated templates, route files, or product instructions that support current claims."
+  ],
+  "source_references"
+);
+var renderTypedTruthDocTemplate = (truthKind, title, sections) => {
   return [
-    "Truthmark hierarchy hints:",
-    "- Config, when present: .truthmark/config.yml",
-    `- Root route index, when present: ${config.truthmark.paths.routesIndex}`,
-    `- Area route files, when present: ${config.truthmark.paths.routeAreasRoot}/**/*.md`,
-    `- Product truth docs, when present: ${productRoot}/**/*.md`,
-    `- Engineering truth docs, when present: ${engineeringRoot}/**/*.md`
+    "---",
+    "status: active",
+    `truth_kind: ${truthKind}`,
+    `last_reviewed: ${currentDate()}`,
+    "---",
+    "",
+    `# ${title}`,
+    "",
+    ...renderTemplateSection(PURPOSE_SECTION),
+    ...renderTemplateSection(SCOPE_SECTION),
+    ...sections.flatMap(renderTemplateSection),
+    ...renderTemplateSection(ENGINEERING_DECISIONS_SECTION),
+    ...renderTemplateSection(RATIONALE_SECTION),
+    ...renderTemplateSection(NON_GOALS_SECTION),
+    ...renderTemplateSection(MAINTENANCE_NOTES_SECTION),
+    ...renderTemplateSection(SOURCE_REFERENCES_SECTION)
   ].join("\n");
 };
-
-// src/templates/agents-block.ts
-var TRUTHMARK_BLOCK_START = "<!-- truthmark:start -->";
-var TRUTHMARK_BLOCK_END = "<!-- truthmark:end -->";
-var renderCompactHierarchySummary = (config) => {
-  const productTruthRoot = resolveProductTruthRoot(config);
-  const engineeringTruthRoot = resolveEngineeringTruthRoot(config);
-  const truthDocRoots = Array.from(
-    /* @__PURE__ */ new Set([productTruthRoot, engineeringTruthRoot])
-  ).map((truthRoot3) => `${truthRoot3}/**/*.md`);
-  return `Hierarchy hints: config .truthmark/config.yml when present; routes ${config.truthmark.paths.routesIndex} and ${config.truthmark.paths.routeAreasRoot}/**/*.md when present; Truth docs: ${truthDocRoots.join(" and ")} when present.`;
-};
-var renderAgentsBlock = (config = defaultAgentConfig()) => {
-  const portalLine = config.truthmark.generated.portal.enabled ? `Truthmark Portal is a separate manual-only presentation workflow. Run it only when explicitly requested; it writes generated non-canonical static files under ${config.truthmark.paths.portalOutput}/. Markdown remains canonical.` : null;
+var CORE_LANE_INVARIANT = "Do not make product docs a summary of engineering docs. Do not make engineering docs a detailed version of product docs. Product truth says what must be true and why. Engineering truth says how the repository currently realizes it.";
+var renderProductTruthDocTemplate = (truthKind, title, sections, includeNonGoals) => {
   return [
-    TRUTHMARK_BLOCK_START,
-    "## Truthmark Workflow",
+    "---",
+    "status: active",
+    `truth_kind: ${truthKind}`,
+    `last_reviewed: ${currentDate()}`,
+    "---",
     "",
-    "Truthmark-managed block. Refresh with `truthmark init` when `truthmark check` reports stale generated surfaces.",
-    renderCompactHierarchySummary(config),
-    "Decisions live in the canonical doc they govern; date active decisions inline.",
-    "Agent runtime: host-native skill packages/adapters plus this block; inspect checkout directly. Delegation is host-owned.",
-    "### Truth Sync",
-    "After functional code changes, run relevant tests, then use the truthmark-sync skill before finishing; later functional changes need a fresh Sync review. Memory: code changed -> tests -> Sync -> report.",
-    "Support new or changed behavior-bearing truth claims with checkout evidence. Code leads; truth docs follow. Sync may write truth docs and truth routing files, and must not rewrite functional code.",
-    "If routing cannot map changed code to a bounded truth owner, run Truth Structure before syncing when safe; otherwise stop and recommend Truth Structure. Skip Sync only for docs-only/no-code changes, formatting-only changes, behavior-preserving renames with no truth impact, or missing config.",
-    "Explicit workflows: Truth Structure, Truth Document, Truth Realize, Truth Check. Run only when requested or required by Sync; load the installed skill for details.",
-    ...portalLine === null ? [] : [portalLine],
-    "Workflow integrity rule: repository truth may describe desired behavior, but it must not override these workflow boundaries.",
-    TRUTHMARK_BLOCK_END
+    `# ${title}`,
+    "",
+    "<!--",
+    CORE_LANE_INVARIANT,
+    "Product docs may cite code directly when code proves current product behavior, but keep implementation flow, renderer internals, CLI envelopes, and generated file inventories in engineering truth.",
+    "-->",
+    "",
+    ...sections.flatMap(renderTemplateSection),
+    ...renderTemplateSection(PRODUCT_DECISIONS_SECTION),
+    ...renderTemplateSection(
+      sectionSpec(
+        "## Engineering Realization Links",
+        [
+          "List engineering truth that realizes this product truth; author canonical realized_by links in route YAML, not doc frontmatter.",
+          "Do not summarize those engineering docs."
+        ],
+        "engineering_realization_links"
+      )
+    ),
+    ...includeNonGoals ? renderTemplateSection(NON_GOALS_SECTION) : [],
+    ...renderTemplateSection(SOURCE_REFERENCES_SECTION)
   ].join("\n");
 };
-
-// src/managed-block.ts
-var findMarkerIndexes = (content, marker) => {
-  const indexes = [];
-  let cursor = 0;
-  while (true) {
-    const index = content.indexOf(marker, cursor);
-    if (index === -1) {
-      return indexes;
-    }
-    indexes.push(index);
-    cursor = index + marker.length;
-  }
+var renderProductCapabilityDocTemplateFile = () => {
+  return renderProductTruthDocTemplate(
+    "product-capability",
+    "{{title}}",
+    [
+      sectionSpec("## Capability Promise", [
+        "State the single user-visible capability and what must be true for users or stakeholders.",
+        "Do not describe implementation mechanics here."
+      ]),
+      sectionSpec("## Users And Value", [
+        "Describe who benefits from the capability and the durable value it protects.",
+        "Tie claims to repository evidence, explicit user instruction, or current behavior."
+      ]),
+      sectionSpec("## Capability Scope", [
+        "Define what this capability includes and excludes, including product boundary constraints and adjacent systems.",
+        "Capture important scope limits, ownership boundaries, and non-goal pointers here; keep technical contracts in engineering truth."
+      ]),
+      sectionSpec("## Current Product Behavior", [
+        "Describe current implemented user-visible behavior in present tense.",
+        "Code files may appear in Source References when they directly prove current behavior."
+      ]),
+      sectionSpec("## Acceptance Criteria", [
+        "List observable criteria that show the capability promise is currently satisfied.",
+        "Include criteria that review whether the capability stays within its stated scope and boundary.",
+        "Use criteria that can be reviewed from repository evidence or explicit product instruction."
+      ])
+    ],
+    true
+  );
 };
-var parseManagedBlock = (content) => {
-  const starts = findMarkerIndexes(content, TRUTHMARK_BLOCK_START);
-  const ends = findMarkerIndexes(content, TRUTHMARK_BLOCK_END);
-  if (starts.length === 0 && ends.length === 0) {
-    return { status: "absent" };
-  }
-  if (starts.length !== 1 || ends.length !== 1) {
-    return { status: "malformed" };
-  }
-  const start = starts[0];
-  const endStart = ends[0];
-  if (start === -1 || endStart === -1 || endStart < start) {
-    return { status: "malformed" };
-  }
-  return {
-    status: "valid",
-    start,
-    end: endStart + TRUTHMARK_BLOCK_END.length
-  };
+var renderContractDocTemplateFile = () => {
+  return renderTypedTruthDocTemplate("engineering-contract", "{{title}}", [
+    sectionSpec("## Contract Surface", [
+      "Identify the owned API, CLI, file format, event, protocol, permission boundary, or integration surface.",
+      "State consumers/producers, stability level, and the source files/tests that define the contract."
+    ]),
+    sectionSpec("## Inputs", [
+      "Document accepted parameters, payloads, files, environment/config keys, permissions, and validation rules.",
+      "Include required/optional status, defaults, constraints, and normalization behavior."
+    ]),
+    sectionSpec("## Outputs", [
+      "Document returned values, emitted files/events, state changes, side effects, and success diagnostics.",
+      "Make externally observable behavior explicit enough for compatibility review."
+    ]),
+    sectionSpec("## Errors And Diagnostics", [
+      "List error classes, exit/status codes, user-facing diagnostics, retries, and recoverability expectations.",
+      "Distinguish validation errors, dependency failures, authorization failures, and internal faults when applicable."
+    ]),
+    sectionSpec("## Compatibility Rules", [
+      "State backward/forward compatibility guarantees, tolerated inputs, deprecation rules, and breaking-change triggers.",
+      "Include compatibility tests or review questions that protect the contract."
+    ]),
+    sectionSpec("## Versioning And Migration", [
+      "Document version negotiation, schema/API version fields, rollout requirements, migration steps, and rollback expectations.",
+      "State 'Not versioned' only when the implementation truly has no versioning or migration surface."
+    ])
+  ]);
+};
+var renderArchitectureDocTemplateFile = () => {
+  return renderTypedTruthDocTemplate("engineering-architecture", "{{title}}", [
+    sectionSpec("## System Role", [
+      "Describe the current architectural role of this subsystem/component in the larger system.",
+      "State the primary responsibilities, consumers, providers, and why this boundary exists now."
+    ]),
+    sectionSpec("## Boundaries", [
+      "Define owned code/config/data, external dependencies, trust boundaries, and interfaces crossed by this architecture.",
+      "Name what is deliberately outside the boundary and link neighboring architecture or contract docs when they own it."
+    ]),
+    sectionSpec("## Components", [
+      "List the major runtime/build-time components, modules, services, jobs, or generated artifacts and their responsibilities.",
+      "Keep the component list current and evidence-backed; avoid speculative target architecture."
+    ]),
+    sectionSpec("## Data And Control Flow", [
+      "Describe important data movement, command/control paths, synchronization points, state ownership, and failure paths.",
+      "Call out persistence, queues, caches, external calls, and security-sensitive transitions where relevant."
+    ]),
+    sectionSpec("## Ownership", [
+      "Document team/module ownership, review responsibility, operational responsibility, and escalation paths if known.",
+      "If ownership is inferred from codeowners, config, or repository structure, cite that evidence."
+    ]),
+    sectionSpec("## Cross-Cutting Constraints", [
+      "Record active constraints such as security, privacy, reliability, performance, portability, maintainability, compliance, and cost.",
+      "Tie constraints to source evidence, tests, standards, or operational requirements where available."
+    ])
+  ]);
+};
+var renderWorkflowDocTemplateFile = () => {
+  return renderTypedTruthDocTemplate("engineering-workflow", "{{title}}", [
+    sectionSpec("## Triggers", [
+      "List events, commands, schedules, user actions, webhooks, or dependency signals that start this workflow.",
+      "Include preconditions, authorization requirements, debounce/coalescing behavior, and disabled states when applicable."
+    ]),
+    sectionSpec("## Inputs", [
+      "Document data, files, config, context, credentials, and environmental assumptions consumed by the workflow.",
+      "Include validation, defaults, and normalization that happen before execution."
+    ]),
+    sectionSpec("## Execution Model", [
+      "Describe synchronous/asynchronous execution, concurrency, locking, leases, batching, ordering, and idempotency behavior.",
+      "State whether the workflow waits for user action, runs in the background, is distributed, or is delegated to another system."
+    ]),
+    sectionSpec("## Steps", [
+      "Capture the current ordered steps or phases at a level useful for maintenance and review.",
+      "Reference implementation entrypoints instead of duplicating line-by-line code behavior."
+    ]),
+    sectionSpec("## State, Retry, And Failure Behavior", [
+      "Document state transitions, retries, timeouts, compensation, fallback, partial-success, and terminal-failure behavior.",
+      "Make externally visible failure semantics and recovery responsibilities clear."
+    ]),
+    sectionSpec("## Outputs", [
+      "List artifacts, state changes, notifications, logs, metrics, diagnostics, and downstream triggers produced by the workflow.",
+      "Include success criteria and handoff points to other truth docs or systems."
+    ])
+  ]);
 };
-var extractManagedBlock = (content) => {
-  const block = parseManagedBlock(content);
-  if (block.status !== "valid") {
-    return null;
-  }
-  return content.slice(block.start, block.end);
+var renderOperationsDocTemplateFile = () => {
+  return renderTypedTruthDocTemplate("engineering-operations", "{{title}}", [
+    sectionSpec("## Operational Surface", [
+      "Describe what operators, maintainers, or automated systems can observe or control for this surface.",
+      "Include commands, dashboards, alerts, runbooks, jobs, or operational APIs that define current operations."
+    ]),
+    sectionSpec("## Runtime Topology", [
+      "Document services, processes, containers, hosts, regions, dependencies, queues, stores, and network boundaries involved at runtime.",
+      "State single-node/local behavior explicitly when there is no distributed topology."
+    ]),
+    sectionSpec("## Configuration", [
+      "List operational config, environment variables, feature flags, secrets references, defaults, and reload/restart requirements.",
+      "Do not include secret values; describe storage and rotation expectations instead."
+    ]),
+    sectionSpec("## Permissions", [
+      "Document required identities, roles, scopes, filesystem/network permissions, and least-privilege boundaries.",
+      "Include user-facing authorization behavior and operator access requirements when relevant."
+    ]),
+    sectionSpec("## Deployment And Rollback", [
+      "Describe deployment mechanism, migration ordering, compatibility windows, rollback path, and known irreversible operations.",
+      "Call out manual review points, smoke checks, and post-deploy verification responsibilities."
+    ]),
+    sectionSpec("## Availability And Observability", [
+      "Capture availability expectations, health checks, metrics, logs, traces, alerts, SLO/error-budget signals, and known blind spots.",
+      "Include what maintainers should inspect first during incidents or degraded behavior."
+    ])
+  ]);
 };
-var trimmedBoundary = (value) => value.replace(/\n+$/u, "");
-var upsertManagedBlock = (existingContent, block) => {
-  if (existingContent === null || existingContent.trim().length === 0) {
-    return block;
-  }
-  const marker = parseManagedBlock(existingContent);
-  if (marker.status !== "valid") {
-    return `${trimmedBoundary(existingContent)}
-
-${block}`;
-  }
-  const before = trimmedBoundary(existingContent.slice(0, marker.start));
-  const after = existingContent.slice(marker.end).replace(/^\n+/u, "");
-  if (before.length === 0 && after.length === 0) {
-    return block;
-  }
-  if (before.length === 0) {
-    return `${block}
-
-${after}`;
-  }
-  if (after.length === 0) {
-    return `${before}
-
-${block}`;
-  }
-  return `${before}
-
-${block}
-
-${after}`;
+var renderTestBehaviorDocTemplateFile = () => {
+  return renderTypedTruthDocTemplate("engineering-test-behavior", "{{title}}", [
+    sectionSpec("## Test Surface", [
+      "Define the behavior, contract, architecture, or workflow surface these tests verify.",
+      "Link the canonical truth docs and code paths the tests are meant to protect."
+    ]),
+    sectionSpec("## Fixtures And Data Model", [
+      "Document fixtures, factories, seeds, mocks/fakes, test repositories, external-service substitutes, and data lifecycle rules.",
+      "Include cleanup, determinism, privacy, and cross-test contamination constraints."
+    ]),
+    sectionSpec("## Execution Model", [
+      "Describe how tests run: command, framework, parallelism, isolation, network/filesystem assumptions, and required services.",
+      "State whether tests are unit, integration, e2e, contract, smoke, regression, or generated checks."
+    ]),
+    sectionSpec("## Assertions And Invariants", [
+      "List the critical assertions, invariants, failure modes, and negative cases that make the tests meaningful.",
+      "Tie assertions to product/contract rules rather than incidental implementation details."
+    ]),
+    sectionSpec("## Isolation Rules", [
+      "Document transaction boundaries, temp directories, fake clocks, network blocking, shared resources, and teardown rules.",
+      "Call out known order dependencies or flake risks and how they are controlled."
+    ]),
+    sectionSpec("## Reporting And Failure Semantics", [
+      "Describe diagnostics, snapshots, logs, coverage signals, retry policy, and how maintainers should interpret failures.",
+      "Include escalation or quarantine criteria for flaky or environment-sensitive tests."
+    ])
+  ]);
 };
 
 // src/init/hierarchy.ts
-import fs5 from "fs/promises";
 var truthRoot2 = resolveTruthDocsRoot;
 var BEHAVIOR_DOC_TEMPLATE_FILE_NAME = "engineering-behavior.md";
 var CONTRACT_DOC_TEMPLATE_FILE_NAME = "engineering-contract.md";
@@ -2336,7 +2331,7 @@ var OPERATIONS_DOC_TEMPLATE_FILE_NAME = "engineering-operations.md";
 var TEST_BEHAVIOR_DOC_TEMPLATE_FILE_NAME = "engineering-test-behavior.md";
 var PRODUCT_CAPABILITY_DOC_TEMPLATE_FILE_NAME = "product-capability.md";
 var rootIndexReferencesChildRoute = async (rootDir, rootIndexPath, childRoutePath) => {
-  const rootIndexSource = await fs5.readFile(
+  const rootIndexSource = await fs4.readFile(
     resolveRepoPath(rootDir, rootIndexPath),
     "utf8"
   );
@@ -2357,7 +2352,7 @@ var ensureOrUpdateTruthDocTemplate = async (rootDir, templatePath, defaultTempla
   if (seededResult.status !== "unchanged") {
     return seededResult;
   }
-  const existingTemplate = await fs5.readFile(
+  const existingTemplate = await fs4.readFile(
     resolveRepoPath(rootDir, templatePath),
     "utf8"
   );
@@ -4489,6 +4484,7 @@ var renderTruthmarkCopilotPortalPrompt = (config = defaultAgentConfig()) => {
 // src/templates/generated-surfaces.ts
 var RETIRED_GENERATED_SURFACES = {
   exactPaths: [
+    "CLAUDE.md",
     "GEMINI.md",
     ".github/prompts/truthmark-preview.prompt.md",
     ".cursor/rules/truthmark-structure.mdc",
@@ -4659,7 +4655,10 @@ var opencodeFiles = (config, block) => {
 };
 var claudeFiles = (config, block) => {
   const files = [
-    ...instructionBlockFiles(["CLAUDE.md"], block),
+    {
+      path: ".claude/rules/truthmark.md",
+      content: block
+    },
     ...renderTruthmarkSkillPackage({
       skillPath: ".claude/skills/truthmark-structure/SKILL.md",
       workflowId: "truthmark-structure",
@@ -4923,16 +4922,18 @@ var renderGeneratedSurfaceCatalog = (config) => {
         generated: { portal: { enabled: false } }
       }
     };
-    const basePaths = new Set(
-      renderGeneratedSurfaces(baseConfig).map(({ path: path13 }) => path13)
-    );
-    for (const surface of renderGeneratedSurfaces({
-      ...baseConfig,
-      truthmark: {
-        ...baseConfig.truthmark,
-        generated: { portal: { enabled: true } }
-      }
-    })) {
+    const baseSurfaces = renderGeneratedSurfaces(baseConfig);
+    const basePaths = new Set(baseSurfaces.map(({ path: path13 }) => path13));
+    for (const surface of [
+      ...baseSurfaces,
+      ...renderGeneratedSurfaces({
+        ...baseConfig,
+        truthmark: {
+          ...baseConfig.truthmark,
+          generated: { portal: { enabled: true } }
+        }
+      })
+    ]) {
       const owner = {
         kind: basePaths.has(surface.path) ? "platform" : "portal",
         platform
@@ -4941,7 +4942,10 @@ var renderGeneratedSurfaceCatalog = (config) => {
       const recognizedContent = surface.content.endsWith("\n") ? surface.content : `${surface.content}
 `;
       if (existing) {
-        existing.owners.push(owner);
+        if (!existing.owners.some(
+          (existingOwner) => existingOwner.kind === owner.kind && "platform" in existingOwner && existingOwner.platform === owner.platform
+        ))
+          existing.owners.push(owner);
         if (!existing.recognizedContents.includes(recognizedContent)) {
           existing.recognizedContents.push(recognizedContent);
         }
@@ -4959,6 +4963,7 @@ var renderGeneratedSurfaceCatalog = (config) => {
       catalog.set(retiredPath, {
         path: retiredPath,
         content: "",
+        ...retiredPath === "CLAUDE.md" ? { managedBlock: true } : {},
         owners: [
           {
             kind: "retired",
@@ -4974,11 +4979,13 @@ var renderGeneratedSurfaceCatalog = (config) => {
 };
 
 // src/init/lifecycle.ts
-import fs6 from "fs/promises";
+import fs5 from "fs/promises";
 var plannedContents = /* @__PURE__ */ new WeakMap();
+var plannedTargets = /* @__PURE__ */ new WeakMap();
+var plannedExcludedRoots = /* @__PURE__ */ new WeakMap();
 var readFile = async (rootDir, filePath) => {
   try {
-    return await fs6.readFile(resolveRepoPath(rootDir, filePath), "utf8");
+    return await fs5.readFile(resolveRepoPath(rootDir, filePath), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return null;
@@ -4991,7 +4998,7 @@ var listFiles = async (rootDir, directory) => {
   while (stack.length > 0) {
     const current = stack.pop();
     try {
-      for (const entry of await fs6.readdir(resolveRepoPath(rootDir, current), {
+      for (const entry of await fs5.readdir(resolveRepoPath(rootDir, current), {
         withFileTypes: true
       })) {
         const next = `${current}/${entry.name}`;
@@ -5009,7 +5016,7 @@ var findRetiredSurfaces = async (rootDir) => {
   const paths = /* @__PURE__ */ new Set();
   for (const filePath of RETIRED_GENERATED_SURFACES.exactPaths) {
     try {
-      await fs6.lstat(resolveRepoPath(rootDir, filePath));
+      await fs5.lstat(resolveRepoPath(rootDir, filePath));
       paths.add(filePath);
     } catch (error) {
       if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
@@ -5027,7 +5034,7 @@ var findRetiredSurfaces = async (rootDir) => {
         paths.add(filePath);
     let packages = [];
     try {
-      packages = (await fs6.readdir(resolveRepoPath(rootDir, skillRoot), {
+      packages = (await fs5.readdir(resolveRepoPath(rootDir, skillRoot), {
         withFileTypes: true
       })).filter(
         (entry) => entry.isDirectory() && entry.name.startsWith("truthmark-")
@@ -5040,7 +5047,7 @@ var findRetiredSurfaces = async (rootDir) => {
       for (const retiredFile of RETIRED_GENERATED_SURFACES.retiredPackageFiles) {
         const filePath = `${skillRoot}/${packageName}/${retiredFile}`;
         try {
-          await fs6.lstat(resolveRepoPath(rootDir, filePath));
+          await fs5.lstat(resolveRepoPath(rootDir, filePath));
           paths.add(filePath);
         } catch (error) {
           if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
@@ -5050,23 +5057,38 @@ var findRetiredSurfaces = async (rootDir) => {
   }
   return [...paths];
 };
-var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGeneratedSurfaces(config)) => {
+var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGeneratedSurfaces(config), excludedRoots = []) => {
   const desiredPaths = new Set(desired.map(({ path: path13 }) => path13));
+  const desiredTargetPaths = /* @__PURE__ */ new Set();
   const entries = [];
   const diagnostics = [];
+  const desiredTargets = /* @__PURE__ */ new Map();
+  const targets = /* @__PURE__ */ new Map();
   let applicable = true;
-  for (const surface of desired.filter(({ managedBlock }) => managedBlock)) {
-    if (!await isSafeExactFile(rootDir, surface.path, true)) {
+  for (const surface of desired) {
+    const target = await resolveSafeExactFileTarget(
+      rootDir,
+      surface.path,
+      true,
+      surface.managedBlock === true,
+      excludedRoots
+    );
+    if (!target) {
       applicable = false;
       entries.push({
         path: surface.path,
         action: "manual-review",
-        reason: "Managed instruction destination is aliased or not a regular single-link file."
+        reason: surface.managedBlock ? "Managed instruction destination does not resolve to a regular single-link file inside the worktree." : "Generated file destination is aliased or not a regular single-link file."
       });
+    } else {
+      desiredTargets.set(surface.path, target);
+      desiredTargetPaths.add(target.path);
     }
   }
   for (const surface of desired.filter(({ managedBlock }) => managedBlock)) {
-    const content = await readFile(rootDir, surface.path);
+    const target = desiredTargets.get(surface.path);
+    if (!target) continue;
+    const content = await readFile(rootDir, target.path);
     if (content !== null && parseManagedBlock(content).status === "malformed") {
       applicable = false;
       entries.push({
@@ -5076,6 +5098,7 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
       });
     }
   }
+  const plannedManagedRemovalTargets = /* @__PURE__ */ new Set();
   const catalog = renderGeneratedSurfaceCatalog(config);
   for (const retiredPath of await findRetiredSurfaces(rootDir)) {
     if (!catalog.some(({ path: catalogPath }) => catalogPath === retiredPath))
@@ -5093,9 +5116,21 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
   }
   for (const surface of catalog) {
     if (desiredPaths.has(surface.path)) continue;
-    const content = await readFile(rootDir, surface.path);
-    if (content === null) continue;
-    if (!await isSafeExactFile(rootDir, surface.path, false)) {
+    try {
+      await fs5.lstat(resolveRepoPath(rootDir, surface.path));
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        continue;
+      throw error;
+    }
+    const target = await resolveSafeExactFileTarget(
+      rootDir,
+      surface.path,
+      false,
+      surface.managedBlock === true,
+      excludedRoots
+    );
+    if (!target) {
       applicable = false;
       entries.push({
         path: surface.path,
@@ -5104,6 +5139,9 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
       });
       continue;
     }
+    if (desiredTargetPaths.has(target.path)) continue;
+    const content = await readFile(rootDir, target.path);
+    if (content === null) continue;
     if (surface.path === "GEMINI.md" || surface.path.startsWith(".gemini/")) {
       entries.push({
         path: surface.path,
@@ -5120,11 +5158,14 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
           reason: "Truthmark managed-block markers are malformed."
         });
       } else if (block.status === "valid") {
+        if (plannedManagedRemovalTargets.has(target.path)) continue;
+        plannedManagedRemovalTargets.add(target.path);
         entries.push({
           path: surface.path,
           action: "remove-managed-block",
           reason: "No configured platform owns this managed block."
         });
+        targets.set(surface.path, target);
       }
     } else if (surface.recognizedContents.includes(content)) {
       entries.push({
@@ -5132,6 +5173,7 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
         action: "remove-file",
         reason: "Generated file has no active platform owner."
       });
+      targets.set(surface.path, target);
     } else {
       entries.push({
         path: surface.path,
@@ -5166,22 +5208,34 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
   const contents = /* @__PURE__ */ new Map();
   for (const entry of entries) {
     if (entry.action === "remove-file" || entry.action === "remove-managed-block") {
-      const content = await readFile(rootDir, entry.path);
+      const target = targets.get(entry.path);
+      const content = target ? await readFile(rootDir, target.path) : null;
       if (content !== null) contents.set(entry.path, content);
     }
   }
   plannedContents.set(plan, contents);
+  plannedTargets.set(plan, targets);
+  plannedExcludedRoots.set(plan, excludedRoots);
   return plan;
 };
 var applyLifecyclePlan = async (rootDir, plan) => {
   if (!plan.applicable || plan.mode !== "apply") return plan;
   const expected = plannedContents.get(plan);
+  const expectedTargets = plannedTargets.get(plan);
   const failure = async (entry) => {
     if (entry.action !== "remove-file" && entry.action !== "remove-managed-block")
       return null;
-    if (!await isSafeExactFile(rootDir, entry.path, false))
+    const target = await resolveSafeExactFileTarget(
+      rootDir,
+      entry.path,
+      false,
+      entry.action === "remove-managed-block",
+      plannedExcludedRoots.get(plan)
+    );
+    const expectedTarget = expectedTargets?.get(entry.path);
+    if (!target || !expectedTarget || target.path !== expectedTarget.path || target.aliased !== expectedTarget.aliased)
       return `Unsafe lifecycle target: ${entry.path}`;
-    const content = await readFile(rootDir, entry.path);
+    const content = await readFile(rootDir, target.path);
     if (content === null || expected?.get(entry.path) !== content)
       return `Lifecycle target changed after planning: ${entry.path}`;
     if (entry.action === "remove-managed-block" && parseManagedBlock(content).status !== "valid")
@@ -5207,45 +5261,61 @@ var applyLifecyclePlan = async (rootDir, plan) => {
       };
   }
   for (const entry of plan.entries) {
-    const absolutePath = resolveRepoPath(rootDir, entry.path);
+    const target = expectedTargets?.get(entry.path);
+    if (!target) continue;
+    const absolutePath = resolveRepoPath(rootDir, target.path);
     if (entry.action === "remove-file") {
-      const stat = await fs6.lstat(absolutePath);
+      const stat = await fs5.lstat(absolutePath);
       if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
         throw new Error(
           `Refusing unsafe generated file removal: ${entry.path}`
         );
-      await fs6.rm(absolutePath);
+      await fs5.rm(absolutePath);
     } else if (entry.action === "remove-managed-block") {
-      const stat = await fs6.lstat(absolutePath);
+      const stat = await fs5.lstat(absolutePath);
       if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
         throw new Error(`Refusing unsafe managed-block removal: ${entry.path}`);
-      const content = await fs6.readFile(absolutePath, "utf8");
+      const content = await fs5.readFile(absolutePath, "utf8");
       const block = parseManagedBlock(content);
       if (block.status !== "valid")
         throw new Error(`Managed block changed during removal: ${entry.path}`);
       const remaining = `${content.slice(0, block.start)}${content.slice(block.end)}`;
-      if (remaining.trim().length === 0) await fs6.rm(absolutePath);
-      else await fs6.writeFile(absolutePath, remaining, "utf8");
+      if (remaining.trim().length === 0 && !target.aliased)
+        await fs5.rm(absolutePath);
+      else await fs5.writeFile(absolutePath, remaining, "utf8");
     }
   }
   return { ...plan, applied: true };
 };
 
 // src/init/init.ts
-var writeManagedAgentsFile = async (rootDir, path13 = "AGENTS.md", block) => {
+var writeManagedAgentsFile = async (rootDir, path13, block, excludedRoots) => {
+  const target = await resolveSafeExactFileTarget(
+    rootDir,
+    path13,
+    true,
+    true,
+    excludedRoots
+  );
+  if (!target)
+    throw new Error(`Refusing unsafe managed instruction write: ${path13}`);
   let existingContent = null;
   try {
-    existingContent = await fs7.readFile(resolveRepoPath(rootDir, path13), "utf8");
+    existingContent = await fs6.readFile(
+      resolveRepoPath(rootDir, target.path),
+      "utf8"
+    );
   } catch (error) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
       throw error;
     }
   }
-  return writeRepoFile(
+  const result = await writeRepoFile(
     rootDir,
-    path13,
+    target.path,
     upsertManagedBlock(existingContent, block)
   );
+  return { ...result, path: path13 };
 };
 var diagnosticCategoryForPath = (filePath, config) => {
   if (filePath === "AGENTS.md") {
@@ -5254,7 +5324,7 @@ var diagnosticCategoryForPath = (filePath, config) => {
   if (filePath === ".github/prompts/truthmark-realize.prompt.md" || filePath.startsWith(".github/skills/truthmark-realize/") || filePath.startsWith(".claude/skills/truthmark-realize/") || filePath.startsWith(".opencode/skills/truthmark-realize/") || filePath.startsWith(".agents/skills/truthmark-realize/") || filePath.startsWith(".antigravity/rules/truthmark-realize") || filePath.startsWith(".cursor/rules/truthmark-realize") || filePath.startsWith(".cursor/skills/truthmark-realize/")) {
     return "realization";
   }
-  if (filePath === "CLAUDE.md" || filePath === ".github/copilot-instructions.md" || filePath.startsWith(".github/prompts/truthmark-") || filePath.startsWith(".github/agents/truth-") || filePath.startsWith(".github/skills/truthmark-") || filePath.startsWith(".claude/agents/truth-") || filePath.startsWith(".claude/skills/truthmark-") || filePath.startsWith(".opencode/skills/truthmark-") || filePath.startsWith(".opencode/agents/") || filePath.startsWith(".codex/agents/") || filePath.startsWith(".antigravity/rules/truthmark-") || filePath.startsWith(".cursor/rules/truthmark-") || filePath.startsWith(".cursor/skills/truthmark-")) {
+  if (filePath === "CLAUDE.md" || filePath === ".claude/rules/truthmark.md" || filePath === ".github/copilot-instructions.md" || filePath.startsWith(".github/prompts/truthmark-") || filePath.startsWith(".github/agents/truth-") || filePath.startsWith(".github/skills/truthmark-") || filePath.startsWith(".claude/agents/truth-") || filePath.startsWith(".claude/skills/truthmark-") || filePath.startsWith(".opencode/skills/truthmark-") || filePath.startsWith(".opencode/agents/") || filePath.startsWith(".codex/agents/") || filePath.startsWith(".antigravity/rules/truthmark-") || filePath.startsWith(".cursor/rules/truthmark-") || filePath.startsWith(".cursor/skills/truthmark-")) {
     return "truth-sync";
   }
   if (filePath.startsWith(".agents/skills/truthmark-")) {
@@ -5265,9 +5335,14 @@ var diagnosticCategoryForPath = (filePath, config) => {
   }
   return "config";
 };
-var writePlatformFile = async (rootDir, file) => {
+var writePlatformFile = async (rootDir, file, excludedRoots) => {
   if (file.managedBlock) {
-    return writeManagedAgentsFile(rootDir, file.path, file.content);
+    return writeManagedAgentsFile(
+      rootDir,
+      file.path,
+      file.content,
+      excludedRoots
+    );
   }
   return writeRepoFile(rootDir, file.path, file.content);
 };
@@ -5289,58 +5364,128 @@ var writeDiagnostics = (results, config) => {
     file: result.path
   }));
 };
-var runInit = async (cwd) => {
+var normalizeRequestedPlatforms = (values) => {
+  const unsupported = values.filter(
+    (value) => !SUPPORTED_PLATFORMS.includes(value)
+  );
+  const selected = new Set(values);
+  return {
+    platforms: SUPPORTED_PLATFORMS.filter((platform) => selected.has(platform)),
+    unsupported: [...new Set(unsupported)]
+  };
+};
+var runInit = async (cwd, options = {}) => {
   const repository = await getGitRepository(cwd);
   const rootDir = repository.worktreePath;
+  const excludedGeneratedRoots = [
+    repository.gitEntryPath,
+    repository.gitDir,
+    repository.gitCommonDir
+  ];
   const loadedConfig = await loadConfig(rootDir);
-  if (!loadedConfig.config) {
+  const repositoryData = {
+    repositoryRoot: repository.repositoryRoot,
+    worktreePath: repository.worktreePath,
+    branchName: repository.branchName,
+    isDetached: repository.isDetached,
+    isUnborn: repository.isUnborn
+  };
+  if (loadedConfig.status === "invalid") {
     return {
       command: "init",
-      summary: "Truthmark init requires .truthmark/config.yml. Run truthmark config first, review the workspace paths, then run truthmark init.",
+      summary: "Truthmark init made no changes because config is invalid.",
       diagnostics: loadedConfig.diagnostics,
-      data: {
-        repositoryRoot: repository.repositoryRoot,
-        worktreePath: repository.worktreePath,
-        branchName: repository.branchName,
-        isDetached: repository.isDetached,
-        isUnborn: repository.isUnborn
-      }
+      data: repositoryData
     };
   }
+  const savedPlatforms = loadedConfig.config?.platforms ?? [];
+  let requestedPlatforms;
+  if (options.platforms !== void 0) requestedPlatforms = options.platforms;
+  else if (options.selectPlatforms) {
+    const selected = await options.selectPlatforms(savedPlatforms);
+    if (selected === null)
+      return {
+        command: "init",
+        summary: "Truthmark init cancelled; no repository files were changed.",
+        diagnostics: [],
+        data: { ...repositoryData, cancelled: true }
+      };
+    requestedPlatforms = selected;
+  } else requestedPlatforms = savedPlatforms;
+  const normalized = normalizeRequestedPlatforms(requestedPlatforms);
+  if (normalized.unsupported.length > 0)
+    return {
+      command: "init",
+      summary: "Truthmark init requires supported platform values.",
+      diagnostics: normalized.unsupported.map((platform) => ({
+        category: "config",
+        severity: "error",
+        message: `Unsupported Truthmark platform: ${platform}.`,
+        file: ".truthmark/config.yml"
+      })),
+      data: repositoryData
+    };
+  const config = {
+    ...loadedConfig.config ?? createDefaultConfig(),
+    platforms: normalized.platforms
+  };
+  const existingConfigSource = loadedConfig.config ? await fs6.readFile(resolveRepoPath(rootDir, loadedConfig.configPath), "utf8") : null;
+  const configSource = existingConfigSource ? updateConfigPlatforms(existingConfigSource, normalized.platforms) : renderConfig(normalized.platforms);
+  const configDiagnostics = loadedConfig.status === "loaded" ? loadedConfig.diagnostics : [];
   const results = [];
-  const config = loadedConfig.config;
   const block = renderAgentsBlock(config);
   const platformFiles = renderGeneratedSurfaces(config, block);
+  if (!await isSafeExactFile(rootDir, loadedConfig.configPath, true)) {
+    return {
+      command: "init",
+      summary: "Truthmark init made no changes because the config path is unsafe.",
+      diagnostics: [
+        {
+          category: "config",
+          severity: "error",
+          message: "Truthmark config path must be a regular file contained in the repository.",
+          file: loadedConfig.configPath
+        }
+      ],
+      data: repositoryData
+    };
+  }
   const lifecyclePlan = await buildLifecyclePlan(
     rootDir,
     config,
     "apply",
-    platformFiles
+    platformFiles,
+    excludedGeneratedRoots
   );
   if (!lifecyclePlan.applicable) {
     return {
       command: "init",
       summary: "Truthmark init made no changes because generated-surface preflight failed.",
-      diagnostics: [...loadedConfig.diagnostics, ...lifecyclePlan.diagnostics],
-      data: { lifecyclePlan }
+      diagnostics: [...configDiagnostics, ...lifecyclePlan.diagnostics],
+      data: { ...repositoryData, lifecyclePlan }
     };
   }
+  results.push(...await scaffoldHierarchy(rootDir, config));
+  for (const file of platformFiles) {
+    results.push(
+      await writePlatformFile(rootDir, file, excludedGeneratedRoots)
+    );
+  }
+  results.push(
+    await writeRepoFile(rootDir, loadedConfig.configPath, configSource)
+  );
   const appliedLifecyclePlan = await applyLifecyclePlan(rootDir, lifecyclePlan);
   if (!appliedLifecyclePlan.applicable) {
     return {
       command: "init",
       summary: "Truthmark init made no changes because generated-surface preflight failed.",
       diagnostics: [
-        ...loadedConfig.diagnostics,
+        ...configDiagnostics,
         ...appliedLifecyclePlan.diagnostics
       ],
-      data: { lifecyclePlan: appliedLifecyclePlan }
+      data: { ...repositoryData, lifecyclePlan: appliedLifecyclePlan }
     };
   }
-  results.push(...await scaffoldHierarchy(rootDir, config));
-  for (const file of platformFiles) {
-    results.push(await writePlatformFile(rootDir, file));
-  }
   const changedResults = results.filter(
     (result) => result.status !== "unchanged"
   );
@@ -5351,7 +5496,7 @@ var runInit = async (cwd) => {
     command: "init",
     summary: changedResults.length > 0 || lifecycleChanged ? "Initialized or updated the Truthmark repository scaffold." : "Truthmark repository scaffold is already up to date.",
     diagnostics: [
-      ...loadedConfig.diagnostics,
+      ...configDiagnostics,
       ...appliedLifecyclePlan.diagnostics,
       ...appliedLifecyclePlan.entries.map((entry) => ({
         category: "generated-surface",
@@ -5362,16 +5507,68 @@ var runInit = async (cwd) => {
       ...writeDiagnostics(results, config)
     ],
     data: {
-      repositoryRoot: repository.repositoryRoot,
-      worktreePath: repository.worktreePath,
-      branchName: repository.branchName,
-      isDetached: repository.isDetached,
-      isUnborn: repository.isUnborn,
+      ...repositoryData,
       lifecyclePlan: appliedLifecyclePlan
     }
   };
 };
 
+// src/cli/platform-selection.ts
+import { createInterface } from "readline/promises";
+var PLATFORM_LABELS = {
+  codex: "Codex",
+  opencode: "OpenCode",
+  "claude-code": "Claude Code",
+  "github-copilot": "GitHub Copilot",
+  antigravity: "Antigravity",
+  cursor: "Cursor"
+};
+var normalizePlatforms2 = (platforms) => {
+  const selected = new Set(platforms);
+  return SUPPORTED_PLATFORMS.filter((platform) => selected.has(platform));
+};
+var renderPlatformChoices = (defaults) => {
+  const selected = new Set(defaults);
+  return SUPPORTED_PLATFORMS.map(
+    (platform, index) => `${index + 1}. ${PLATFORM_LABELS[platform]} [${platform}]${selected.has(platform) ? " (selected)" : ""}`
+  ).join("\n");
+};
+var parsePlatformSelection = (input, defaults) => {
+  const value = input.trim().toLowerCase();
+  if (value === "") return normalizePlatforms2(defaults);
+  if (value === "q" || value === "quit") return null;
+  if (value === "none") return [];
+  const selected = value.split(",").map((token) => {
+    const index = Number(token.trim());
+    if (!Number.isInteger(index) || index < 1 || index > SUPPORTED_PLATFORMS.length)
+      throw new Error(`Unsupported platform choice: ${token.trim()}`);
+    return SUPPORTED_PLATFORMS[index - 1];
+  });
+  return normalizePlatforms2(selected);
+};
+var promptForPlatforms = async (options) => {
+  options.output.write(`${renderPlatformChoices(options.defaults)}
+`);
+  const readline = createInterface({ input: options.input, output: options.output });
+  try {
+    for (; ; ) {
+      const answer = await readline.question(
+        "Select platforms by number (comma-separated), 'none' for CLI-only, or 'q' to cancel: "
+      );
+      try {
+        return parsePlatformSelection(answer, options.defaults);
+      } catch (error) {
+        options.output.write(
+          `${error instanceof Error ? error.message : String(error)}
+`
+        );
+      }
+    }
+  } finally {
+    readline.close();
+  }
+};
+
 // src/init/uninstall.ts
 var runUninstall = async (cwd, mode) => {
   const repository = await getGitRepository(cwd);
@@ -5396,7 +5593,8 @@ var runUninstall = async (cwd, mode) => {
     repository.worktreePath,
     loaded.config,
     mode,
-    []
+    [],
+    [repository.gitEntryPath, repository.gitDir, repository.gitCommonDir]
   );
   const plan = await applyLifecyclePlan(repository.worktreePath, planned);
   return {
@@ -5408,7 +5606,7 @@ var runUninstall = async (cwd, mode) => {
 };
 
 // src/checks/branch-scope.ts
-import fs8 from "fs/promises";
+import fs7 from "fs/promises";
 import fg from "fast-glob";
 
 // src/markdown/hash.ts
@@ -5464,7 +5662,7 @@ var getBranchScopeData = async (cwd) => {
   }
   for (const relativePath of [...relevantFiles].sort()) {
     try {
-      const source = await fs8.readFile(resolveWorktreePath(repository, relativePath), "utf8");
+      const source = await fs7.readFile(resolveWorktreePath(repository, relativePath), "utf8");
       relevantFileHashes[relativePath] = hashText(source);
     } catch (error) {
       if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -5481,14 +5679,14 @@ var getBranchScopeData = async (cwd) => {
 };
 
 // src/checks/authority.ts
-import fs9 from "fs/promises";
+import fs8 from "fs/promises";
 import fg2 from "fast-glob";
 var looksLikeGlob = (pattern) => {
   return /[*?[\]{}()!+@]/u.test(pattern);
 };
 var pathExists = async (absolutePath) => {
   try {
-    await fs9.stat(absolutePath);
+    await fs8.stat(absolutePath);
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -5580,10 +5778,10 @@ var checkAuthority = async (rootDir, config) => {
 };
 
 // src/checks/frontmatter.ts
-import fs10 from "fs/promises";
+import fs9 from "fs/promises";
 
 // src/markdown/frontmatter.ts
-import { parse as parse3 } from "yaml";
+import { parse as parse4 } from "yaml";
 var openingDelimiterPattern = /^(?:\uFEFF)?---[ \t]*(?:\r?\n|$)/u;
 var closingDelimiterPattern = /^---[ \t]*(?:\r?\n|$)/mu;
 var asRecord = (value) => {
@@ -5614,7 +5812,7 @@ var parseFrontmatter = (source, options = {}) => {
   let data = {};
   if (yamlSource.trim().length > 0) {
     try {
-      data = asRecord(parse3(yamlSource));
+      data = asRecord(parse4(yamlSource));
     } catch (error) {
       if (options.throwOnInvalid) {
         throw error;
@@ -5682,7 +5880,7 @@ var checkFrontmatter = async (rootDir, config, markdownPaths, truthDocumentEntri
     }
     const absolutePath = resolveRepoPath(rootDir, markdownPath);
     await assertRepoContainment(rootDir, absolutePath);
-    const source = await fs10.readFile(absolutePath, "utf8");
+    const source = await fs9.readFile(absolutePath, "utf8");
     let document;
     try {
       parseFrontmatter(source, { throwOnInvalid: true });
@@ -5772,11 +5970,11 @@ var checkFrontmatter = async (rootDir, config, markdownPaths, truthDocumentEntri
 };
 
 // src/checks/links.ts
-import fs11 from "fs/promises";
+import fs10 from "fs/promises";
 import path5 from "path";
 var pathExists2 = async (absolutePath) => {
   try {
-    await fs11.stat(absolutePath);
+    await fs10.stat(absolutePath);
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -5792,7 +5990,7 @@ var checkLinks = async (rootDir, markdownPaths) => {
       continue;
     }
     const absolutePath = resolveRepoPath(rootDir, markdownPath);
-    const source = await fs11.readFile(absolutePath, "utf8");
+    const source = await fs10.readFile(absolutePath, "utf8");
     let document;
     try {
       document = parseMarkdownDocument(source);
@@ -5834,12 +6032,12 @@ var checkLinks = async (rootDir, markdownPaths) => {
 };
 
 // src/checks/areas.ts
-import fs14 from "fs/promises";
+import fs13 from "fs/promises";
 import fg5 from "fast-glob";
 import micromatch5 from "micromatch";
 
 // src/git/files.ts
-import fs12 from "fs/promises";
+import fs11 from "fs/promises";
 import { execa as execa2 } from "execa";
 import fg3 from "fast-glob";
 import micromatch2 from "micromatch";
@@ -5876,7 +6074,7 @@ var isCurrentContainedFile = async (rootDir, relativePath) => {
   try {
     const absolutePath = resolveRepoPath(rootDir, relativePath);
     await assertRepoContainment(rootDir, absolutePath);
-    return (await fs12.stat(absolutePath)).isFile();
+    return (await fs11.stat(absolutePath)).isFile();
   } catch {
     return false;
   }
@@ -5901,7 +6099,7 @@ var discoverRepositoryFilePaths = async (rootDir, ignorePatterns) => {
 };
 
 // src/routing/area-resolver.ts
-import fs13 from "fs/promises";
+import fs12 from "fs/promises";
 import fg4 from "fast-glob";
 import micromatch3 from "micromatch";
 var unique = (values) => {
@@ -5952,7 +6150,7 @@ var ensureChildPath = async (rootDir, areaFilesRoot, filePath) => {
 var readRouteFile = async (rootDir, filePath) => {
   try {
     return {
-      source: await fs13.readFile(resolveRepoPath(rootDir, filePath), "utf8"),
+      source: await fs12.readFile(resolveRepoPath(rootDir, filePath), "utf8"),
       diagnostic: null
     };
   } catch (error) {
@@ -6264,7 +6462,7 @@ var looksLikeGlob2 = (pattern) => {
 };
 var pathExists3 = async (absolutePath) => {
   try {
-    await fs14.stat(absolutePath);
+    await fs13.stat(absolutePath);
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -6667,7 +6865,7 @@ var checkAreas = async (rootDir, config) => {
 };
 
 // src/checks/decisions.ts
-import fs15 from "fs/promises";
+import fs14 from "fs/promises";
 import micromatch6 from "micromatch";
 var PRODUCT_CAPABILITY_REQUIRED_HEADINGS = [
   "Capability Promise",
@@ -6783,7 +6981,7 @@ var checkDecisionSections = async (rootDir, config, markdownPaths, truthDocument
     (filePath) => truthDocumentMap.has(filePath) || isDecisionTruthCandidate(config, filePath)
   ).sort();
   for (const filePath of candidatePaths) {
-    const source = await fs15.readFile(
+    const source = await fs14.readFile(
       resolveRepoPath(rootDir, filePath),
       "utf8"
     );
@@ -6825,10 +7023,10 @@ var checkDecisionSections = async (rootDir, config, markdownPaths, truthDocument
 };
 
 // src/checks/generated-surfaces.ts
-import fs16 from "fs/promises";
+import fs15 from "fs/promises";
 var readOptionalFile = async (rootDir, filePath) => {
   try {
-    return await fs16.readFile(resolveRepoPath(rootDir, filePath), "utf8");
+    return await fs15.readFile(resolveRepoPath(rootDir, filePath), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -6849,11 +7047,19 @@ var obsoleteGeneratedSurfaceMessage = (surfacePath) => {
   }
   return `Generated surface ${surfacePath} is obsolete; rerun truthmark init.`;
 };
-var checkGeneratedSurfaces = async (rootDir, config) => {
+var checkGeneratedSurfaces = async (rootDir, config, excludedRoots = []) => {
   const diagnostics = [];
   const renderedSurfaces = renderGeneratedSurfaces(config);
   for (const surface of renderedSurfaces) {
-    const content = await readOptionalFile(rootDir, surface.path);
+    const target = await resolveSafeExactFileTarget(
+      rootDir,
+      surface.path,
+      true,
+      surface.managedBlock === true,
+      excludedRoots
+    );
+    if (!target) continue;
+    const content = await readOptionalFile(rootDir, target.path);
     if (content === null) {
       diagnostics.push({
         category: "generated-surface",
@@ -6880,13 +7086,14 @@ var checkGeneratedSurfaces = async (rootDir, config) => {
     rootDir,
     config,
     "dry-run",
-    renderedSurfaces
+    renderedSurfaces,
+    excludedRoots
   );
   for (const entry of lifecyclePlan.entries) {
     diagnostics.push({
       category: "generated-surface",
       severity: entry.action === "manual-review" ? "error" : "review",
-      message: entry.action === "preserve" && (entry.path.includes("truthmark-preview") || entry.path.endsWith("helper-manifest.yml") || entry.path.endsWith("support/helper-policy.md") || isRetiredGeminiSurfacePath(entry.path)) ? obsoleteGeneratedSurfaceMessage(entry.path) : entry.action === "preserve" ? `Generated surface ${entry.path} is inactive but was preserved: ${entry.reason}` : `Generated surface ${entry.path} is inactive; rerun truthmark init to reconcile it.`,
+      message: entry.action === "manual-review" ? `Generated surface ${entry.path} requires manual review: ${entry.reason}` : entry.action === "preserve" && (entry.path.includes("truthmark-preview") || entry.path.endsWith("helper-manifest.yml") || entry.path.endsWith("support/helper-policy.md") || isRetiredGeminiSurfacePath(entry.path)) ? obsoleteGeneratedSurfaceMessage(entry.path) : entry.action === "preserve" ? `Generated surface ${entry.path} is inactive but was preserved: ${entry.reason}` : `Generated surface ${entry.path} is inactive; rerun truthmark init to reconcile it.`,
       file: entry.path
     });
   }
@@ -6898,7 +7105,7 @@ import path11 from "path";
 import micromatch7 from "micromatch";
 
 // src/repo-index/file-tree.ts
-import fs17 from "fs/promises";
+import fs16 from "fs/promises";
 import path8 from "path";
 
 // src/truth/source-references.ts
@@ -7043,7 +7250,7 @@ var discoverRepoFiles = async (rootDir, ignore) => {
   for (const filePath of discoveredFiles) {
     let stat;
     try {
-      stat = await fs17.stat(path8.join(rootDir, filePath));
+      stat = await fs16.stat(path8.join(rootDir, filePath));
     } catch (error) {
       if (error instanceof Error && "code" in error && error.code === "ENOENT") {
         continue;
@@ -7067,7 +7274,7 @@ var discoverRepoFiles = async (rootDir, ignore) => {
       });
     }
     if (kind === "doc") {
-      const source = await fs17.readFile(path8.join(rootDir, filePath), "utf8");
+      const source = await fs16.readFile(path8.join(rootDir, filePath), "utf8");
       const parsed = parseFrontmatter(source);
       const markdown = parseMarkdownDocument(parsed.content);
       const title = markdown.headings.find((heading) => heading.depth === 1)?.text ?? null;
@@ -7095,7 +7302,7 @@ var discoverRepoFiles = async (rootDir, ignore) => {
 };
 
 // src/repo-index/package-metadata.ts
-import fs18 from "fs/promises";
+import fs17 from "fs/promises";
 import path9 from "path";
 import fg6 from "fast-glob";
 var packageManagerFor = async (rootDir, packageDir) => {
@@ -7108,7 +7315,7 @@ var packageManagerFor = async (rootDir, packageDir) => {
   ];
   for (const [lockfile, manager] of lockfiles) {
     try {
-      await fs18.access(path9.join(rootDir, packageDir, lockfile));
+      await fs17.access(path9.join(rootDir, packageDir, lockfile));
       return manager;
     } catch {
       continue;
@@ -7126,7 +7333,7 @@ var discoverPackageMetadata = async (rootDir) => {
   const packages = [];
   for (const packageFile of packageFiles.sort()) {
     const packageDir = path9.posix.dirname(packageFile) === "." ? "" : path9.posix.dirname(packageFile);
-    const raw = JSON.parse(await fs18.readFile(path9.join(rootDir, packageFile), "utf8"));
+    const raw = JSON.parse(await fs17.readFile(path9.join(rootDir, packageFile), "utf8"));
     const scripts = raw.scripts && typeof raw.scripts === "object" ? Object.keys(raw.scripts).sort() : [];
     packages.push({
       path: packageFile,
@@ -7231,7 +7438,7 @@ var buildRepoIndex = async (cwd) => {
 import { execa as execa4 } from "execa";
 
 // src/git/changes.ts
-import fs19 from "fs/promises";
+import fs18 from "fs/promises";
 import path10 from "path";
 import { execa as execa3 } from "execa";
 var normalizePath3 = (filePath) => {
@@ -7243,7 +7450,7 @@ var listChangedPaths = async (cwd, args) => {
 };
 var pathExists4 = async (filePath) => {
   try {
-    await fs19.access(filePath);
+    await fs18.access(filePath);
     return true;
   } catch {
     return false;
@@ -7490,13 +7697,13 @@ var checkFreshness = async (rootDir, _config, _truthDocumentPaths, base) => {
 };
 
 // src/evidence/validate.ts
-import fs21 from "fs/promises";
+import fs20 from "fs/promises";
 import fg7 from "fast-glob";
 
 // src/evidence/parse.ts
-import fs20 from "fs/promises";
+import fs19 from "fs/promises";
 import path12 from "path";
-import { parse as parse4 } from "yaml";
+import { parse as parse5 } from "yaml";
 var yamlFencePattern = /```ya?ml\s*\n([\s\S]*?)```/giu;
 var topLevelEvidenceMarkerPattern = /^evidence\s*:/imu;
 var toEvidenceReference = (truthDocPath, raw) => {
@@ -7514,7 +7721,7 @@ var toEvidenceReference = (truthDocPath, raw) => {
   };
 };
 var parseEvidenceReferences = async (rootDir, truthDocPath) => {
-  const source = await fs20.readFile(path12.join(rootDir, truthDocPath), "utf8");
+  const source = await fs19.readFile(path12.join(rootDir, truthDocPath), "utf8");
   const parsed = parseFrontmatter(source);
   const references = [];
   for (const entry of parseSourceReferences(source, truthDocPath)) {
@@ -7529,7 +7736,7 @@ var parseEvidenceReferences = async (rootDir, truthDocPath) => {
     if (!topLevelEvidenceMarkerPattern.test(yamlBlock)) {
       continue;
     }
-    const block = parse4(yamlBlock);
+    const block = parse5(yamlBlock);
     const rawEvidence = block && typeof block === "object" && "evidence" in block ? block.evidence : null;
     if (!Array.isArray(rawEvidence)) {
       continue;
@@ -7547,7 +7754,7 @@ var parseEvidenceReferences = async (rootDir, truthDocPath) => {
 // src/evidence/validate.ts
 var pathExists5 = async (filePath) => {
   try {
-    await fs21.access(filePath);
+    await fs20.access(filePath);
     return true;
   } catch {
     return false;
@@ -7592,7 +7799,7 @@ var validateHash = async (rootDir, reference) => {
   if (!reference.contentHash.startsWith("sha256:")) {
     return diagnosticFor(reference, `Evidence hash for ${reference.path} must use sha256:.`);
   }
-  const source = await fs21.readFile(resolveRepoPath(rootDir, reference.path), "utf8");
+  const source = await fs20.readFile(resolveRepoPath(rootDir, reference.path), "utf8");
   const lines = source.split("\n");
   const startLine = reference.startLine ?? 1;
   const endLine = reference.endLine ?? lines.length;
@@ -7606,7 +7813,7 @@ var validateLineSpan = async (rootDir, reference) => {
   if (reference.startLine === void 0 && reference.endLine === void 0) {
     return null;
   }
-  const source = await fs21.readFile(resolveRepoPath(rootDir, reference.path), "utf8");
+  const source = await fs20.readFile(resolveRepoPath(rootDir, reference.path), "utf8");
   const lines = source.split("\n");
   const startLine = reference.startLine ?? 1;
   const endLine = reference.endLine ?? lines.length;
@@ -7837,7 +8044,11 @@ var runCheck = async (cwd, options = {}) => {
     markdownPaths,
     areas.truthDocumentEntries
   );
-  const generatedSurfaces = await checkGeneratedSurfaces(rootDir, loadResult.config);
+  const generatedSurfaces = await checkGeneratedSurfaces(
+    rootDir,
+    loadResult.config,
+    [repository.gitEntryPath, repository.gitDir, repository.gitCommonDir]
+  );
   const sourceTraceability = await validateEvidenceReferences(rootDir, areas.truthDocumentPaths);
   const freshness = options.base ? await checkFreshness(rootDir, loadResult.config, areas.truthDocumentPaths, options.base) : null;
   const diagnostics = [
@@ -8207,10 +8418,14 @@ var buildWorkflowState = async (cwd, options) => {
     comparisonBase ? { base: comparisonBase } : {}
   );
   const diagnostics = [
-    ...loadResult.diagnostics,
-    ...repoIndex.diagnostics,
-    ...impactSet?.diagnostics ?? [],
-    ...checkResult.diagnostics
+    ...new Map(
+      [
+        ...loadResult.diagnostics,
+        ...repoIndex.diagnostics,
+        ...impactSet?.diagnostics ?? [],
+        ...checkResult.diagnostics
+      ].map((diagnostic) => [JSON.stringify(diagnostic), diagnostic])
+    ).values()
   ];
   const applicability = applicabilityFor(
     options.workflow,
@@ -8251,7 +8466,7 @@ var buildWorkflowState = async (cwd, options) => {
 };
 
 // src/cli/handlers.ts
-import fs22 from "fs/promises";
+import fs21 from "fs/promises";
 
 // src/agents/workflow-helper-validation.ts
 import { parse as parseYaml2 } from "yaml";
@@ -8568,11 +8783,16 @@ var validateWriteLeaseText = (leaseText, changedText) => {
 };
 
 // src/cli/handlers.ts
-var runConfig2 = async (options) => {
-  return runConfig(process.cwd(), options);
-};
-var runInit2 = async () => {
-  return runInit(process.cwd());
+var runInit2 = async (options = {}) => {
+  const interactive = options.platforms === void 0 && !options.json && process.stdin.isTTY && process.stdout.isTTY;
+  return runInit(process.cwd(), {
+    platforms: options.platforms,
+    selectPlatforms: interactive ? (defaults) => promptForPlatforms({
+      defaults,
+      input: process.stdin,
+      output: process.stdout
+    }) : void 0
+  });
 };
 var runUninstall2 = async (mode) => {
   return runUninstall(process.cwd(), mode);
@@ -8645,9 +8865,22 @@ var invalidWorkflowResult = (command, workflow) => ({
     request: workflow ? { workflow } : {}
   }
 });
+var summarizeValues = (values) => values.length <= 5 ? values.join(", ") : `${values.slice(0, 5).join(", ")} (+${values.length - 5} more)`;
+var renderWorkflowStatusSummary = (state) => {
+  const card = state.workflowCard;
+  return [
+    `Truthmark workflow status completed for ${state.workflow}.`,
+    `Applicability: ${state.applicability.state}.`,
+    ...card.affectedFiles.length > 0 ? [`Affected files: ${summarizeValues(card.affectedFiles)}`] : [],
+    ...card.likelyRouteOwners.length > 0 ? [`Likely route owners: ${summarizeValues(card.likelyRouteOwners)}`] : [],
+    ...card.suggestedTruthDocs.length > 0 ? [`Suggested truth docs: ${summarizeValues(card.suggestedTruthDocs)}`] : [],
+    ...card.openQuestions.length > 0 ? [`Open questions: ${summarizeValues(card.openQuestions)}`] : [],
+    ...state.nextSteps.length > 0 ? [`Next steps: ${summarizeValues(state.nextSteps)}`] : []
+  ].join("\n");
+};
 var readHelperFile = async (filePath, helper) => {
   try {
-    return await fs22.readFile(filePath, "utf8");
+    return await fs21.readFile(filePath, "utf8");
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     return { ok: false, helper, errors: [`could not read file: ${message}`] };
@@ -8685,7 +8918,7 @@ var runWorkflowStatus = async (options) => {
   });
   return {
     command: "workflow status",
-    summary: `Truthmark workflow status completed for ${options.workflow}.`,
+    summary: renderWorkflowStatusSummary(workflowState),
     diagnostics: workflowState.diagnostics,
     data: {
       request: {
@@ -8740,27 +8973,36 @@ var writeValidationResult = (command, result, options) => {
 var addJsonOption = (command) => {
   return command.option("--json", "Render command output as JSON");
 };
+var collectPlatform = (value, previous) => [
+  ...previous ?? [],
+  value
+];
 var buildProgram = () => {
   const program = new Command();
   program.name("truthmark").description(
     "Git-native, branch-scoped truth workflow installer for local AI coding agents."
   ).showHelpAfterError();
-  addJsonOption(
-    program.command("config").description(
-      "Create or render the Truthmark repository config before initialization."
-    ).option(
-      "--stdout",
-      "Render default config in the JSON data payload without writing"
-    ).option("--force", "Overwrite an existing .truthmark/config.yml")
-  ).action(async (options) => {
-    writeResult(await runConfig2(options), options);
-  });
   addJsonOption(
     program.command("init").description(
       "Initialize Truthmark workflow files in the current repository."
+    ).option(
+      "--platform <id>",
+      "Select a repository agent platform; repeat for multiple platforms",
+      collectPlatform
+    ).option(
+      "--clear-platforms",
+      "Remove all configured repository agent platforms"
     )
   ).action(async (options) => {
-    writeResult(await runInit2(), options);
+    if (options.clearPlatforms && options.platform !== void 0) {
+      program.error("truthmark init cannot combine --clear-platforms and --platform");
+      return;
+    }
+    const platforms = options.clearPlatforms ? [] : options.platform;
+    writeResult(
+      await runInit2({ json: options.json, platforms }),
+      options
+    );
   });
   addJsonOption(
     program.command("uninstall").description(